Malicious code in beaver-ui-form-object (npm)
The npm package beaver-ui-form-object contains malicious code that, upon installation or import, automatically downloads and executes attacker-controlled native binaries on the host system. The package's index.js loads a polyfill script that fetches platform-specific executables from suspicious external domains, writes them to temporary directories under disguised filenames, sets executable permissions, and spawns them detached. This behavior occurs without version pinning, hash verification, or use of first-party domains, enabling silent remote code execution.
AI Analysis
Technical Summary
The beaver-ui-form-object npm package versions 34.7.5, 12.1.7, and 35.7.3 include malicious functionality where the index.js script loads a polyfill that dynamically assembles domain names to fetch opaque platform-specific binaries over HTTPS from non-trusted external hosts. These binaries are saved to temporary directories with disguised names, permissions are set to executable, and the binaries are spawned detached via shell commands. A secondary module, lib/telemetry.js, performs similar fetch-write-execute actions using base64 buffer assembly and dynamic chmod calls. There is no integrity verification or use of first-party domains, resulting in automatic execution of attacker-controlled native code upon package use.
Potential Impact
This malicious package enables remote code execution on the host system immediately upon installation or import, allowing attackers to run arbitrary native code with the privileges of the user executing the package. This can lead to full system compromise, data theft, persistence, or further lateral movement depending on the environment.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately avoid installing or importing the affected versions of beaver-ui-form-object (=12.1.7, =34.7.5, =35.7.3). Remove any existing installations of these versions from systems. Monitor for suspicious processes spawned from temporary directories with disguised executable names. Verify package integrity and source before installation. Consider using trusted package registries and supply chain security tools to detect malicious packages.
Malicious code in beaver-ui-form-object (npm)
Description
The npm package beaver-ui-form-object contains malicious code that, upon installation or import, automatically downloads and executes attacker-controlled native binaries on the host system. The package's index.js loads a polyfill script that fetches platform-specific executables from suspicious external domains, writes them to temporary directories under disguised filenames, sets executable permissions, and spawns them detached. This behavior occurs without version pinning, hash verification, or use of first-party domains, enabling silent remote code execution.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The beaver-ui-form-object npm package versions 34.7.5, 12.1.7, and 35.7.3 include malicious functionality where the index.js script loads a polyfill that dynamically assembles domain names to fetch opaque platform-specific binaries over HTTPS from non-trusted external hosts. These binaries are saved to temporary directories with disguised names, permissions are set to executable, and the binaries are spawned detached via shell commands. A secondary module, lib/telemetry.js, performs similar fetch-write-execute actions using base64 buffer assembly and dynamic chmod calls. There is no integrity verification or use of first-party domains, resulting in automatic execution of attacker-controlled native code upon package use.
Potential Impact
This malicious package enables remote code execution on the host system immediately upon installation or import, allowing attackers to run arbitrary native code with the privileges of the user executing the package. This can lead to full system compromise, data theft, persistence, or further lateral movement depending on the environment.
Defensive Guidance
No official patch or remediation is currently documented. Users should immediately avoid installing or importing the affected versions of beaver-ui-form-object (=12.1.7, =34.7.5, =35.7.3). Remove any existing installations of these versions from systems. Monitor for suspicious processes spawned from temporary directories with disguised executable names. Verify package integrity and source before installation. Consider using trusted package registries and supply chain security tools to detect malicious packages.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12145
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a738531bf8831d5394f0733
Added to database: 08/05/2026, 18:47:13 UTC
Last enriched: 08/05/2026, 21:03:03 UTC
Last updated: 08/05/2026, 21:03:03 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.