beaver-ui-multi-select-with-all@35.6.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Importing or requiring the package entrypoint index.js.

Arbitrary attacker-controlled native code can execute with the importing process's privileges.

remote payload download, temp-file drop, and detached execution

On package import, index.js silently requires _loader.js. The loader contacts rotating worker hosts for a platform-specific binary and falls back to DNS TXT chunks, writes the received bytes into a temporary executable, then launches it detached through cmd.exe or /bin/sh. This is an unverified remote-code-execution chain unrelated to the advertised UI component.

The import-time loader provides a concrete, unconsented remote payload execution chain. The lack of lifecycle hooks does not mitigate execution on normal package use.