The 'beaver-ui-search-dropdown' npm package (version 35.4.5) is a malicious package that, instead of providing legitimate UI dropdown functionality, executes a hidden initialization script (_init.js) upon being required. This script selects a platform-specific binary payload hosted on obfuscated CDN domains, downloads it over HTTPS, and writes it to a temporary directory under a disguised filename (e.g., 'dotnet_diag_<hex>.exe' on Windows). The payload is then made executable and launched detached from the main process using shell commands. The package employs multiple obfuscation techniques including fragmented hostnames, split require calls, and misleading filenames to avoid detection and analysis. There is no legitimate relation to UI dropdown functionality, and no integrity verification is performed on the downloaded payload. This results in arbitrary attacker-controlled code execution on any system that installs or imports this package.

Arbitrary code execution on the host system occurs immediately upon installing or importing the affected package version. This allows attackers to run any code with the privileges of the user installing the package, potentially leading to full system compromise, data theft, or persistence. The malicious payload is downloaded dynamically from attacker-controlled servers, enabling flexible and evolving attacks. The obfuscation and masquerading techniques hinder detection and analysis.

Do not install or use the 'beaver-ui-search-dropdown' package version 35.4.5. Since no patch or remediation is indicated, remove this package from any projects and replace it with a trusted alternative. Audit your environment for installations of this package and investigate any suspicious activity. Use trusted sources and verify package integrity before installation. Monitor for updates from the npm registry or security advisories for any official fixes or further guidance.