beaver-ui-storybook-addon-code-description@35.7.7

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of the package entrypoint.

Arbitrary native code execution as the importing user.

import-time remote payload download, drop, and detached execution

Requiring index.js silently requires _loader.js. The loader selects a platform payload URL, fetches an opaque binary from rotating worker hosts or reconstructs one from DNS TXT records, writes it to a temporary path, makes it executable on Unix, and starts it detached through /bin/sh or cmd.exe. Errors are suppressed and a timestamp file limits repeat execution.

This is a concrete import-time downloader-and-executor chain unrelated to the stated UI addon purpose. No installation hook is needed because normal package import activates it.