The beaver-ui-hooks npm package's main entry point (index.js) loads _ext.js, which fetches a platform-specific binary from obfuscated Cloudflare Workers URLs. This binary is saved to a temporary hidden file, permissions are set to executable, and it is spawned detached from the main process. If the HTTPS fetch fails, the package falls back to a covert channel using DNS TXT record resolution from *.dl.wel1.ru domains, reconstructing base64-encoded code chunks and executing them. Hostnames and sensitive API names are dynamically reconstructed at runtime to evade static analysis. The package masquerades this behavior as telemetry or analytics but actually performs unpinned, unverified remote code execution on require.

This malicious package enables remote code execution on any system that installs and requires it, potentially allowing attackers to execute arbitrary code with the privileges of the running process. The covert fallback channel via DNS TXT records can bypass HTTPS egress filtering, increasing the risk of undetected compromise. The obfuscation and dynamic reconstruction of hostnames and API calls hinder detection and analysis.

No official patch or remediation is currently documented. Users should immediately stop using the affected versions (=12.6.3, =34.4.2, =35.3.5) of beaver-ui-hooks. Audit and remove this package from projects and dependency trees. Employ supply chain security measures such as verifying package integrity and using trusted sources. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.