beaver-ui-actions-button@5.4.9

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Any application code requiring the package.

Arbitrary native code executes with the importing process user's permissions.

obfuscated remote binary download, staging, and detached execution

Requiring index.js imports setup.js. That code fetches a platform-specific payload from obfuscated worker hosts, or decodes one from DNS TXT records, writes it into a temp directory, marks it executable on Unix, and runs it detached through execFile. It suppresses errors and removes the staged file after five seconds, while presenting the behavior as telemetry.

This is a concrete import-time remote-code-execution chain, not legitimate telemetry. Its obfuscated endpoints, DNS fallback, detached execution, and cleanup indicate malicious intent.