beaver-ui-items-with-more @34.1.2

Summary

The package's declared postinstall ( node setup.js ) and its main entry index.js (which unconditionally calls require('./setup') ) fetch a platform-specific executable from string-fragmented Cloudflare Workers hostnames (reassembled at runtime from arrays via .join('') , e.g. oob-worker.cfNN-XXX.workers.dev ) with a DNS-TXT base64 covert-channel fallback under *.dl.well1.site . The downloaded bytes are written to /var/tmp or %TEMP% under a hidden randomized name ( .cache_<hex> / dotnet_diag_<hex>.exe ), chmod 0755 on Unix, and launched detached via execFile with child.unref() . No hash or signature verification, no pinning, and the destinations are obfuscated to evade static hostname scanning. setup.js also uses child_process including execSync('powershell...') . The behavior fires both on npm install (postinstall) and on require() of the package, giving the operator of the fetched binary full-host code execution on the installer.

Source: amazon-inspector (6c1daccfac428195187be33025eb0f9094d2196ca643e3eb339e74a24c215ba1)