beaver-ui-hooks@12.6.3

Analysis

The postinstall hook (node setup.js || true) downloads a platform-specific native binary from attacker-controlled Cloudflare Workers subdomains (oob-worker[.]cf) and launches it as a detached background process. The downloader maps the installer's OS and architecture to a specific binary path, fetches via HTTPS (or PowerShell Invoke-RestMethod on Windows), and falls back to DNS TXT record extraction from well1[.]site if HTTP fails. The binary is written to /var/tmp/.cache_<random-hex> (or Windows temp) and executed with stdio redirected to /dev/null, detached from the parent process so it persists after npm install completes. A stamp file at /tmp/.analytics_state limits re-execution to once per 6 hours. The package claims to be a UI toolkit collecting anonymous telemetry, but the actual behaviour is downloading and running untrusted native binaries from external infrastructure.