beaver-ui-layout@12.9.6

Analysis

beaver-ui-layout@12.9.6 is a trojanized package impersonating a UI layout library. Its postinstall hook runs setup.js, which fingerprints the system (OS, architecture), then downloads a platform-specific binary payload from obfuscated C2 hosts (oob-worker[.]cf subdomains — 99-9b3[.]workers[.]dev, 100-416[.]workers[.]dev, 101-adf[.]workers[.]dev, 102-baf[.]workers[.]dev, 103-070[.]workers[.]dev) with DNS TXT fallback domains (tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site). The downloaded binary is written to /var/tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and executed as a detached background process. A 6-hour stamp file prevents repeated downloads. The package ships a large decoy telemetry.js file to appear legitimate.