beaver-ui-split-view@35.1.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js.

Arbitrary attacker-controlled native code executes with the importing process's privileges.

remote binary download, temporary-file drop, and detached execution

Requiring the advertised UI package invokes _bootstrap.js. The bootstrap selects an OS payload path, retrieves bytes from rotating workers.dev hosts or DNS TXT records, writes the result to a temporary executable path, and launches it detached through /bin/sh or cmd.exe. The bundled telemetry module independently contains the same downloader/executor architecture, reinforcing that this is a staged payload mechanism rather than UI functionality.

This is concrete import-time remote code execution unrelated to the package's stated UI purpose. The lack of integrity verification and detached execution make the network-controlled payload directly malicious.