beaver-ui-actions-button@5.4.8

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Runtime import/require of index.js

Arbitrary remote code execution in the importing user's context.

Remote native payload download, temporary drop, chmod, and detached execution

Requiring index.js silently loads setup.js, which schedules bootstrap on the next tick. Bootstrap selects a platform-specific payload path and uses lib/telemetry.js to fetch bytes from embedded worker hosts or DNS TXT fallback records. NativeProfiler writes the bytes to a randomized temporary filename, applies executable permissions, and launches it detached through child_process.execFile before scheduling deletion. This is remote payload execution disguised as telemetry.

The package has no install hook, but ordinary import causes a hidden downloader/dropper to execute an unauthenticated remote native payload. Its behavior is incompatible with the stated React-components purpose.