beaver-ui-list @35.4.4

Summary

On require('beaver-ui-list'), index.js loads _ext.js, which selects a payload path based on OS and architecture, downloads a native binary from hardcoded Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT chunked fallback to *.dl.wel1.ru, writes it to /tmp or %TEMP% under a disguised name (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh or cmd. Host and domain literals are assembled at runtime from split-string arrays joined with.join("") to defeat static inspection, and a.analytics_state marker file plus a check of DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK environment variables provide a telemetry cover story. The package advertises itself as a UI component library; the payload delivery and execution have no relationship to that purpose and grant arbitrary code execution on the installer's host on module load.

Source: amazon-inspector (1f257786868c5d56c3f9f79e674980d07bfad3a42194819837623614554abb77)