registry / beaver-ui-drawer / 9.4.8

beaver-ui-drawer@9.4.8

interface elements

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Install-time code downloads an opaque platform payload, writes it to a temp directory, makes it executable on Unix, and launches it detached. The same bootstrap is also reached by importing the package.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall or require("beaver-ui-drawer")

Impact

Arbitrary remote code executes with the installing user's privileges.

Mechanism

remote binary download/DNS payload retrieval and detached execution

Attack narrative

The postinstall hook loads setup.js, which calls telemetry.run(). NativeProfiler fetches a platform-specific payload from obfuscated hosts or DNS TXT records, writes it to a temp path, sets executable permissions on Unix, and invokes it using child_process.execFile with detached execution. index.js also loads setup.js, making ordinary import another trigger.

Rationale

This UI package contains a concrete remote-payload execution chain unrelated to its stated functionality. The postinstall hook suppresses errors, increasing stealth.

Evidence

package.jsonsetup.jsindex.jslib/telemetry.js/var/tmp/.cache_<random>/tmp/.analytics_state

Network endpoints9

oob-worker.cf99-9b3.workers.devoob-worker.cf100-416.workers.devoob-worker.cf101-adf.workers.dev

beaver-ui-drawer@9.4.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code