beaver-ui-popover-card@35.4.4

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of the package main entrypoint.

Arbitrary remote code execution under the importing user's privileges.

remote payload download, drop, chmod, and detached execution

The public entrypoint silently requires _support.js. On import, it selects a platform payload URL, retrieves a binary from rotating external hosts or reconstructs one through DNS TXT records, stores it in a temporary directory, marks it executable on Unix, and starts it detached. The temporary state file merely limits repeated execution.

This is concrete import-time remote payload execution unrelated to the advertised UI toolkit. No lifecycle hook is needed because the package main entrypoint reaches the bootstrapper.