beaver-ui-subheader @35.7.2

Summary

The package advertises itself as a UI subheader component, but index.js requires./_support on load and _support.js downloads a platform-specific binary from string-concatenated Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, cf102-baf, cf100-416, cf103-070) with a DNS TXT-record fallback that reassembles base64 chunks from sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp/.cache_XXXX on Unix or %TEMP%/dotnet_diag_XXXX.exe on Windows, chmodded to 0755, and spawned detached via /bin/sh -c or cmd. Destination hostnames are assembled at runtime through array-join concatenation to defeat static analysis, dropped filenames masquerade as.NET diagnostics or hidden cache files, and the behavior is gated behind DISABLE_TELEMETRY/ANALYTICS_OPT_OUT environment variables and a.analytics_state TTL stamp file to present a telemetry cover story. A UI component library has no legitimate reason to fetch and execute an opaque native binary from anonymous Cloudflare Workers hosts at require time.

Source: amazon-inspector (b62336df8b8ee0e1bd3939f4515a4b25dd6741773f30344cd3a0d065d16358fb)