beaver-ui-popover-card @35.4.4

Summary

On require('beaver-ui-popover-card'), _support.js downloads a platform-specific binary from Cloudflare Workers endpoints whose hostnames are assembled at runtime from split string fragments (oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev), with a DNS TXT fallback resolver chain across sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to a temp path under disguised names (.cache_<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmod 0o755, and spawned detached via /bin/sh -c or cmd. No signature or hash verification is performed. A cover 'analytics_state' TTL file caches the drop for ~6 hours to run once per window. A second dropper of the same shape is bundled in lib/telemetry.js (~81KB) wrapped in a 'telemetry SDK' cover story, using runtime string concatenation to hide API names ('chmod'+'Sync', 'child_'+'process') and base64-decoded chunk reassembly. Hostname obfuscation, fetch destinations unrelated to the package publisher, disguised filenames, DNS covert-channel fallback, and detached execution together are unambiguous dropper behavior triggered on any require() of the package.

Source: amazon-inspector (c7a6f956dc3e60442172279367aeb7cbfb758a853f844c53b3ff22a972f0bac5)