Malicious code in beaver-ui-popover-marker (npm)

The npm package beaver-ui-popover-marker contains malicious code that executes on require(). The package's index.js loads vendor.js, which initiates a bootstrap routine that downloads platform-specific binaries from obfuscated Cloudflare Workers hosts (oob-worker.cf*.workers.dev, with domains reassembled at runtime). The downloaded binary is written as a hidden file to /var/tmp or Windows Temp with a decoy name (.cache or dotnet_diag_.exe), given execute permissions (0755), and spawned detached via /bin/sh or cmd.\n\nThe malicious code includes a DNS TXT fallback mechanism under *.dl.wel1.ru that reassembles base64-encoded payloads when HTTPS fetches fail. A cover-story opt-out gate honors environment variables (DISABLE_TELEMETRY, ANALYTICS_OPT_OUT, DO_NOT_TRACK) and caches state at /tmp/.analytics_state with a ~5-hour TTL, masquerading as telemetry suppression to avoid re-execution.\n\nThe package is advertised as a legitimate React UI popover component and has no legitimate reason to fetch and execute native binaries from anonymized workers.dev endpoints at import time. Installation or require() of this package grants full-host code execution to an attacker.\n\nThe incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-xmx8-4qhh-xfr8.