beaver-ui-object-card @35.3.8

Summary

On require('beaver-ui-object-card'), index.js loads _ext.js which selects a platform-specific asset path and downloads an unsigned native binary from hardcoded Cloudflare Workers mirrors, with a DNS TXT chunked-base64 fallback resolver, then writes the binary to /var/tmp or %TEMP% under deceptive names (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Destination hosts and resolver domains are reassembled at runtime from split-string arrays (e.g. ["oob-worker.cf100-416.worker","s.de","v"].join("") and ['sdk.dl','.wel','1.r','u'].join("")) to defeat static analysis. A cover-story surrounds the dropper: an 'analytics_state' lock file, a DISABLE_TELEMETRY env gate that does not actually disable execution, a node-fetch/2.6 User-Agent, and an unreachable lib/telemetry.js presenting an 'Analytics SDK' facade. The delivered binary is attacker-controlled, unpinned, unsigned, mismatched to any documented package purpose, and executed detached on the installer's host at import time.

Source: amazon-inspector (4a2a78be16248a4269fca22b39cf436f82f26818c797949af73eca331cc3a0f6)