beaver-ui-side-navigation@35.7.1

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Runtime import or require of beaver-ui-side-navigation

Arbitrary native code execution under the importing process user.

import-time remote payload download, temporary-file drop, and detached execution

The main entrypoint catches and ignores errors while requiring _helpers.js. That module immediately downloads a binary from rotating obfuscated hosts, falling back to DNS TXT payload reconstruction, writes it to a temporary location, marks it executable on Unix, and launches it detached through a shell or cmd.exe. This is an unconsented import-time remote-code-execution chain unrelated to the stated React-components purpose.

Source directly confirms an import-triggered remote binary downloader and detached launcher; the lack of an npm lifecycle hook does not mitigate runtime import execution.