beaver-ui-breadcrumbs@0.0.2

Analysis

beaver-ui-breadcrumbs is a combosquat package impersonating a UI component library. On require(), it loads _compat.js which downloads a platform-specific binary payload from Cloudflare Workers subdomains (oob-worker[.]cf99-9b3[.]workers[.]dev, oob-worker[.]cf101-adf[.]workers[.]dev, oob-worker[.]cf100-416[.]workers[.]dev, oob-worker[.]cf103-070[.]workers[.]dev) via HTTPS GET requests to paths like /pkg/package, /pkg/package-arm64, /pkg/loader_mac, or /pkg/package.exe depending on the host OS and architecture. If the HTTPS download fails, it falls back to a DNS-over-TXT exfiltration channel via well1[.]site domains (tin[.]dl[.]well1[.]site, tina[.]dl[.]well1[.]site, ldr[.]dl[.]well1[.]site, win[.]dl[.]well1[.]site), reassembling base64-encoded chunks from TXT records. The downloaded binary is written to /var/tmp/.cache_<random-hex> on Linux/macOS or %TEMP%\dotnet_diag_<random-hex>.exe on Windows, then spawned as a detached background process (cmd.exe /c start /b on Windows, /bin/sh -c on Unix). A marker file at /tmp/.analytics_state prevents re-download within approximately 6 hours. The package checks for DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, and DO_NOT_TRACK environment variables to conditionally skip execution.