beaver-ui-list@35.4.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of beaver-ui-list through index.js.

Arbitrary attacker-controlled code can execute under the importing process's user account.

Remote payload download or DNS retrieval followed by detached native execution.

The package main file catches and suppresses errors while requiring _ext.js. That module selects a platform payload, downloads it from obfuscated hosts or reconstructs it through DNS TXT records, writes it to a temporary executable path, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe. This is concrete staged remote code execution during ordinary package import.

The reachable import-time loader executes opaque remotely controlled binaries without user action or package-aligned purpose. Absence of lifecycle hooks does not mitigate the import-time execution path.