beaver-ui-search-dropdown @35.4.5

Summary

The package presents itself as a UI dropdown library but on require executes _init.js, which selects a platform-specific asset (linux/darwin/win32), fetches an opaque binary over HTTPS from string-fragmented *.workers.dev hosts (assembled via .join('') to hide the hostname from static scanners) with a DNS-TXT chunked-base64 fallback to *.dl.wel1.ru , writes the payload to /var/tmp or %TEMP% under a disguised name ( dotnet_diag_<hex>.exe on Windows, .cache_<hex> on Unix), chmods it 0755, and spawns it detached via /bin/sh -c "<file> &" or cmd.exe /c start /b . The require("child_"+"process") split, the fragmented CDN host arrays, the.NET-diagnostics filename masquerade, and an analytics_state marker file provide cover-story framing. There is no pinning, hash verification, publisher-matched origin, or relation to a UI dropdown component. Installing or importing the package results in arbitrary attacker-controlled code executing on the installer's host.

Source: amazon-inspector (117b4f6c7e9e402d92085e427c4b40874e9b6838e16c15562408a0bda241f9ae)