beaver-ui-card-large@9.6.3

Analysis

beaver-ui-card-large is a trojanized npm package that poses as a React UI component. On require(), it collects a host fingerprint (hostname, username, cwd, Node.js version) and downloads a platform-specific binary from Cloudflare Workers C2 infrastructure (oob-worker[.]cf subdomain workers) to /var/tmp/.cache_<random> (or C:\Windows\Temp\dotnet_diag_<random>.exe on Windows), then executes it as a detached child process. The binary payloads are served from paths /pkg/package (Linux x64), /pkg/package-arm64 (Linux arm64), /pkg/loader_mac (macOS), and /pkg/package.exe (Windows). A DNS-based fallback resolver at well1[.]site subdomains provides alternative C2 discovery. The package has no lifecycle hooks — the payload runs immediately on require() via process.nextTick.