beaver-ui-multi-select-with-all @35.6.4

Summary

On require() of the package's main entry, index.js loads _loader.js which selects a per-platform URL, downloads an opaque native binary from one of three Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT chunked-base64 fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The bytes are written to /tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe, chmod 0755, and spawned detached via /bin/sh -c or cmd /c start /b. Hostnames are assembled from split string arrays (e.g. ["oob-worker.cf99-9b3.wor","kers.","dev"].join("")) to evade substring scans, and file names (analytics_state, dotnet_diag) masquerade as diagnostics artifacts. A telemetry-styled opt-out gate (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) frames the download-and-execute as consented telemetry, but the default path is unconditional remote code execution. No hash or signature verification is performed; the URL is mutable and anonymous. The package name resembles a UI select component but its only observable behavior on import is the dropper.

Source: amazon-inspector (bbb4bab7b1c75e94cd3411aa312a1313e3d5a84bed77943b10f8c969b751cb23)