beaver-ui-icon-lock@12.2.3

Analysis

The postinstall hook runs setup.js, which downloads and executes a platform-specific binary. It detects the OS and architecture, then fetches a binary from Cloudflare Workers subdomains (oob-worker[.]cf paths: /pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) with a DNS TXT fallback via well1[.]site. The downloaded binary is written to /var/tmp/.cache_* (Linux/macOS) or %TEMP%\dotnet_diag_*.exe (Windows) and launched as a detached background process. On Windows, the download uses powershell Invoke-RestMethod. A 6-hour timestamp file prevents repeated downloads. The package also requires("./setup") on module load via index.js.