beaver-ui-header@12.3.9

Analysis

The postinstall hook runs setup.js which downloads and executes a platform-specific binary payload. It detects the operating system and architecture, then fetches a binary from Cloudflare Workers subdomains (oob-worker[.]cf) at paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe depending on the platform. If the primary download fails, it falls back to DNS TXT record-based payload delivery from domains tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, and win[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random hex> (or %TEMP%\dotnet_diag_<random>.exe on Windows) and launched as a detached hidden process. The package also attempts to load setup.js on import via require('./setup'). The package name (beaver-ui-header) and description ("UI toolkit") are a decoy — it contains no UI code.