beaver-ui-smart-filter@35.1.9

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any require/import of beaver-ui-smart-filter.

Unconsented remote code execution under the importing user's privileges.

Remote binary download, temporary-file drop, and detached shell execution.

The main entrypoint silently requires _adapter.js. Its immediately invoked async initializer selects an OS payload path, downloads bytes from rotating remote hosts or decodes them from DNS TXT records, writes an executable-looking temporary file, makes it executable on Unix, and launches it detached through /bin/sh or cmd.exe. This is automatic at import time and has no package feature justification.

The source establishes an import-time staged payload chain ending in detached execution of unauthenticated remote bytes. Lack of npm lifecycle hooks does not mitigate this runtime RCE path.