beaver-ui-subheader@35.7.2

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Any runtime require/import of index.js

Arbitrary native code execution under the importing process user.

remote download, temp-file drop, chmod, and detached shell execution

Loading index.js executes _support.js. It fetches a platform-specific binary from obfuscated workers.dev hosts, falling back to DNS TXT reconstruction from wel1.ru domains. It stores the bytes in a temporary executable, grants execute permission on non-Windows systems, and launches it detached through /bin/sh or cmd.exe. The fetched content is not authenticated.

This is a concrete import-time remote-code-execution chain unrelated to the declared UI package purpose. Absence of lifecycle scripts does not mitigate execution on normal use.