beaver-ui-split-view @35.1.2

Summary

On require('beaver-ui-split-view'), index.js loads _bootstrap.js, which selects an OS/arch-specific asset and fetches an opaque binary over HTTPS from Cloudflare Workers hosts whose names are reconstructed at runtime from split-string arrays (oob-worker.cf101-adf/cf102-baf/cf103-070.workers.dev), with a DNS-TXT base64 fallback under sdk.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under cover-story names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755, and spawned detached via cp.spawn('/bin/sh', ['-c', fp + ' &'], {detached:true}) or cmd equivalent. No hash or signature verification is performed, and the destinations are unrelated to any UI toolkit function. A ~81KB lib/telemetry.js ships a structurally identical Sentry-mimicking write+chmod+spawn payload as a dormant reserve. Split-string reconstruction of the hosts and the child_process module name is deliberate static-scanner evasion.

Source: amazon-inspector (9b9758e9a6587fb3c1314e69b881d33a634fb0255cf6bdd3540ab74a533aacc1)