beaver-ui-header @34.6.3

Summary

beaver-ui-header@12.3.9 advertises itself as a UI header library but ships a setup.js that runs on npm postinstall and again on require via index.js. It reconstructs network destinations at runtime by joining arrays of substrings (e.g. ['oob-wor','ker.cf','99-9b3.wor','kers','.dev']) to hide Cloudflare Workers hosts of the form oob-worker.cfNN-*.workers.dev, with a DNS-TXT fallback channel that reassembles a base64 payload from numbered TXT records under *.dl.well1.site (c.<domain>, 0.<domain>, 1.<domain>,...). A platform-specific binary is downloaded, staged under /var/tmp or the Windows TEMP directory with a disguised name (dotnet_diag_<tag>.exe on Windows,.cache_<tag> on Unix), chmodded 0755, and launched detached/unref'd via execFile with stdio ignored. Setup.js also invokes execSync('powershell...') on Windows. Variable and env-var names (analytics_state, DISABLE_TELEMETRY, ANALYTICS_OPT_OUT) and the dotnet_diag_ filename frame the flow as telemetry, but the package's stated purpose (UI header component) has no need for platform-specific native binaries, and the destinations are not the publisher's infrastructure. There is no version pin, hash, or signature verification on the downloaded binary.

Source: amazon-inspector (758137caa2a9c3d1dffb2fcffabc810c9b47696f78f20d412151d351d425faa0)