beaver-ui-form@12.6.1

Analysis

The package pretends to be a UI form component but its postinstall hook (node setup.js) downloads and executes platform-specific binaries. It fingerprints the operating system and architecture, then downloads a binary from Cloudflare Workers subdomains (oob-worker[.]cf) or via DNS TXT records from well1[.]site. The downloaded binary is written to /var/tmp/.cache_<hex> on Linux/macOS or %TEMP%\dotnet_diag_<hex>.exe on Windows, then launched as a detached background process. The package also attempts to load the same dropper when imported via require(). A large decoy telemetry.js file pads the package to appear legitimate.