beaver-ui-date-range-picker@12.5.3

Analysis

The package beaver-ui-date-range-picker@12.5.3 is a combosquat pretending to be a UI component library. Its postinstall hook runs setup.js, which fingerprints the system (platform/arch) and downloads a platform-specific binary from Cloudflare Workers C2 infrastructure (oob-worker[.]cf subdomains with workers[.]dev suffix). The binary is written to /var/tmp/.cache_<hex> (Linux/macOS) or %TEMP%\dotnet_diag_<hex>.exe (Windows) and launched as a detached background process. Fallback C2 uses DNS TXT record lookups via well1[.]site domains. The package ships a decoy analytics SDK (lib/telemetry.js) that is never executed by the downloader.