beaver-ui-grid@12.7.3

Analysis

The postinstall hook (node setup.js || true) downloads and executes a platform-specific binary. It resolves the OS and architecture, then fetches a binary from a shuffled list of Cloudflare Workers subdomains (oob-worker[.]cf with hex-prefixed subdomains such as 99-9b3, 100-416, 101-adf, 102-baf, 103-070) with DNS TXT record fallback from tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, and win[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random hex> (or dotnet_diag_<hex>.exe on Windows), made executable, and launched as a detached background process that outlives the installer. The package contains no actual UI components despite its name and description.