beaver-ui-layout @34.2.3

Summary

The package is advertised as a React UI layout library but on require('beaver-ui-layout') loads _bridge.js, which reconstructs hostnames from array-joined string fragments to build Cloudflare Workers URLs (oob-worker.cf100/cf101/cf102-*.workers.dev) and a DNS-TXT covert-channel fallback under *.dl.wel1.ru, downloads a platform-specific binary, writes it to /var/tmp or the Windows TEMP directory under disguised names such as dotnet_diag_*.exe and.cache_*, chmods it 0755, and spawns it detached via cp.spawn('/bin/sh', ['-c', fp+' &']) or spawn('cmd',...). A marker file (analytics_state/.analytics_state) is used to gate re-execution, and DISABLE_TELEMETRY/DO_NOT_TRACK environment variables are checked as a cover story. lib/telemetry.js bundles the same dropper primitives (base64 chunk buffer, chmod 755, /bin/sh spawn, require('child_'+'process') split-string obfuscation) as an alternate variant. Importing this package results in arbitrary attacker-controlled code executing on the installer's host.

Source: amazon-inspector (465b05640a3068a007c565655d946564a39211eeca92f8637b7c3b4fe9c9dece)