beaver-ui-table @35.2.7

Summary

The package's main index.js unconditionally requires./setup.js at load time. setup.js selects a platform-specific path, downloads an opaque native binary over HTTPS from one of four Cloudflare Worker subdomains whose hostnames are assembled by joining string-array fragments at runtime (oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev, cf101-adf.workers.dev, cf102-baf.workers.dev), with a DNS-TXT covert-channel fallback under *.dl.wel1.ru. The fetched bytes are written to /tmp or %TEMP% under disguised names (.cache_<hex>, dotnet_diag_<hex>.exe), chmod 0755'd, and spawned detached via cp.spawn('/bin/sh',['-c',fp+' &'],{detached:true}) or spawn('cmd',...). A rate-limit stamp file (.analytics_state) is written alongside. An unreferenced lib/telemetry.js (~81KB) mirrors the dropper logic (endpoint rotation, DNS discovery, chmod 0755, /bin/sh spawn) as a staged/decoy module. Host obfuscation via.join(''), disguised filenames, anonymous Cloudflare Worker hosting, DNS-TXT fallback, and detached background execution together match the binary-runner dropper pattern; no legitimate native-build or vendor-SDK flow is present.

Source: amazon-inspector (5eaa4db154b26013412a01287354ef2f0ffb074b9bfd27c6e214fd60ddf4c9be)