beaver-ui-form-object@12.1.7

Analysis

The package beaver-ui-form-object is a combosquat of a UI form library. On install, the postinstall hook runs setup.js which fingerprints the operating system and CPU architecture, then downloads a platform-specific binary payload from a shuffled list of Cloudflare Workers subdomains (oob-worker[.]cf/*.workers[.]dev). If the HTTP download fails, it falls back to DNS TXT-record resolution on wel1[.]site subdomains to retrieve the payload via base64-encoded TXT records. The downloaded binary is written to /var/tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows), made executable, and launched as a detached background process with stdout/stderr redirected to /dev/null. The package also attempts to load setup.js on require() via index.js. The README falsely describes this as "anonymous usage metrics" telemetry.