{"id":"MAL-2026-11522","summary":"Malicious code in beaver-ui-form (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d)\nPackage advertises itself as a React UI toolkit but on require(), _helpers.js runs init() at module load which selects a platform-specific URL, fetches a native binary over HTTPS from obfuscated Cloudflare Workers subdomains (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to /tmp under a disguised name (.cache_\u003chex\u003e) on Linux/macOS or to %TEMP% as dotnet_diag_\u003chex\u003e.exe on Windows, chmods 755, and spawns it detached via /bin/sh -c or cmd.exe (_helpers.js:122-128). C2 hostnames are constructed via array-join string splits to evade static analysis, stderr is suppressed by a no-op wrapper, and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK environment checks provide a telemetry cover story. If the HTTPS retrieval fails, the code falls back to a DNS-TXT covert channel: it resolves TXT records at c.\u003csub\u003e.dl.wel1.ru for a chunk count, iterates 0..N.\u003csub\u003e.dl.wel1.ru TXT records (sdk/ext/pkg/net.dl.wel1.ru), base64-decodes the concatenation into a payload buffer, writes it to disk and executes it. Result is full-host remote code execution on any developer machine or CI runner that installs and requires the package.\n","modified":"2026-08-05T10:05:51.283621296Z","published":"2026-08-04T21:12:52Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["34.9.1"],"id":"IN-MAL-2026-010978","import_time":"2026-08-04T21:33:12.063629668Z","modified_time":"2026-08-04T21:12:52Z","sha256":"c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d"},{"versions":["12.6.1"],"id":"IN-MAL-2026-014463","import_time":"2026-08-05T09:28:14.583693792Z","modified_time":"2026-08-05T08:54:08Z","sha256":"f730a613c29fd6c66668d4cb7ff46e1f0dc41db9c33af96955df7f2d0b47585c","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/beaver-ui-form/v/34.9.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/beaver-ui-form/v/12.6.1"}],"affected":[{"package":{"name":"beaver-ui-form","ecosystem":"npm","purl":"pkg:npm/beaver-ui-form"},"versions":["34.9.1","12.6.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"beaver-ui-form-34.9.1.tgz","hashes":{"sha1":"690686e55912a732ddd111e8dd5f2820c2eca4c8","sha512_sri":"sha512-Deycqy4nhuTK8djaYy3OOBSuNv7TsFlzlMIAGXeKdyJpwbl6h6gf0OSIWPFY2WW1B292rspqYj3pvYRGJqTE6Q=="}}],"evidence_files":[{"tlsh":"44b1855a236a71188b70a7e0c7175425f65af6633781c1d4fb6ca9841fb712883b2efc","path":"_helpers.js","sha256":"5be1fa8072631a720b25a8b6b7a2833f8a2e2da3054eef5eb1750a94daddc901"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/beaver-ui-form/MAL-2026-11522.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}