beaver-ui-items-with-more@12.2.6

Analysis

The package runs a postinstall hook (node setup.js) that downloads and executes platform-specific binaries from attacker-controlled infrastructure. It detects the OS and architecture, then fetches a binary from Cloudflare Workers hosts (oob-worker[.]cf subdomains with paths /pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) with fallback DNS TXT-based retrieval from tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, and win[.]dl[.]well1[.]site. The downloaded binary is written to /var/tmp/.cache_<random-hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and launched as a detached background process with stdout/stderr discarded. A 6-hour timestamp file prevents repeated downloads. The package also attempts to load setup.js at require-time via index.js. The lib/telemetry.js file is a decoy analytics SDK to disguise the payload.