beaver-ui-pagination@35.3.7

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import/require of beaver-ui-pagination

Arbitrary remote code execution under the importing process user.

Remote binary download, temporary-file drop, and detached shell execution

The public entrypoint suppresses errors while requiring _init.js, so ordinary import activates it without user configuration. That module retrieves a platform payload from rotating hosts or DNS TXT records, writes it to a temporary path, chmods it on Unix, and starts it through a detached shell. The unrelated telemetry module embeds substantially the same downloader/executor capability.

This is a concrete import-time remote payload execution chain unrelated to a pagination component. Lack of lifecycle hooks does not mitigate the reachable runtime execution.