{"id":"MAL-2026-12143","summary":"Malicious code in beaver-ui-breadcrumbs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d4d5ebbbd036f50f2c29c885260a8b513897fcae3614f714585723f45ad492cd)\nOn require() of the package, index.js loads _compat.js which selects a platform-specific endpoint from an obfuscated host list, downloads an opaque binary from Cloudflare Workers-hosted URLs (with a DNS TXT base64 fallback channel), writes it to /var/tmp or %TEMP% under a disguised name such as dotnet_diag_\u003chex\u003e.exe or.cache_\u003chex\u003e, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start /b. Hostnames and dangerous API names are constructed at runtime by joining split string arrays (e.g. reassembling 'oob-worker.cf...workers.dev' and require('child_'+'process'), fs['chmod'+'Sync']) to evade static analysis. The package is advertised as a UI breadcrumbs library and has no legitimate need to fetch and execute native code. A parallel dropper implementation is also shipped in lib/telemetry.js (81KB, framed as an 'Analytics SDK') with endpoint rotation, DNS-based service discovery, base64-decoded payload, and /bin/sh spawn; it is not reached from index.js in this version but is staged in the tarball.\n","modified":"2026-08-05T10:05:49.364752500Z","published":"2026-08-05T08:52:53Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T08:52:53Z","sha256":"a9d1032ebbf7a1d4822db515b34988c17e9331f1f82360f9912788fcd683acc8","source":"amazon-inspector","versions":["33.1.6"],"id":"IN-MAL-2026-014454","import_time":"2026-08-05T09:28:12.966917081Z"},{"id":"IN-MAL-2026-014458","import_time":"2026-08-05T09:28:13.562521471Z","modified_time":"2026-08-05T08:53:26Z","sha256":"d4d5ebbbd036f50f2c29c885260a8b513897fcae3614f714585723f45ad492cd","source":"amazon-inspector","versions":["0.0.2"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/beaver-ui-breadcrumbs/v/33.1.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/beaver-ui-breadcrumbs/v/0.0.2"}],"affected":[{"package":{"name":"beaver-ui-breadcrumbs","ecosystem":"npm","purl":"pkg:npm/beaver-ui-breadcrumbs"},"versions":["33.1.6","0.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"9df983983dd772dd2582bde4ed2462feecbb1262c303e55e872eca1712159d8b","tlsh":"0da1a79a16a971198bb0dbe487178415f65bf6633380c294fb9ca9885f731248372efc"}],"package_integrity":[{"filename":"beaver-ui-breadcrumbs-33.1.6.tgz","hashes":{"sha512_sri":"sha512-Y2EhCivbylN+L70yZxCwhdEYRv6f5vOJV8AWzxkNtBJ4dMdJnxK/J5ex6W7AFFEzpn+dZpy33VyOcV/hGL/aAw==","sha1":"87b5e14fa6d3bd58ff6808c8d16e678fee80fe6f"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/beaver-ui-breadcrumbs/MAL-2026-12143.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}