Malicious code in beaver-ui-multi-select-with-all (npm)
The npm package 'beaver-ui-multi-select-with-all' version 35.6.4 contains malicious code that, upon import, downloads and executes a native binary from multiple obfuscated URLs without user consent or verification. The package masquerades as a UI component but acts as a dropper for remote code execution. It uses evasion techniques such as splitting hostnames to avoid detection and disguises the downloaded files as diagnostic artifacts. There is no known patch or fix available for this malicious package.
AI Analysis
Technical Summary
The 'beaver-ui-multi-select-with-all' npm package version 35.6.4 is a malicious package that, when required, loads a loader script which selects a platform-specific URL from several Cloudflare Workers subdomains and fallback DNS-TXT chunked-base64 URLs to download an opaque native binary. This binary is saved to temporary directories with names resembling diagnostic tools and executed detached from the main process. The package attempts to frame this behavior as telemetry with opt-out environment variables, but by default performs unconditional remote code execution without hash or signature verification. The URLs are mutable and anonymous, increasing risk. The package's only observable behavior is this dropper activity, not UI functionality.
Potential Impact
This package enables unconditional remote code execution on the host system when imported, allowing an attacker to run arbitrary native code with the privileges of the executing process. The lack of verification and the use of anonymous mutable URLs increase the risk of malicious payload delivery. This can lead to system compromise, data theft, or further malware deployment.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should immediately remove 'beaver-ui-multi-select-with-all' version 35.6.4 from their projects and dependency trees. Avoid installing or importing this package. Use trusted sources and verify package integrity before installation. Monitor for any unexpected processes or files resembling the described behavior and investigate accordingly.
Malicious code in beaver-ui-multi-select-with-all (npm)
Description
The npm package 'beaver-ui-multi-select-with-all' version 35.6.4 contains malicious code that, upon import, downloads and executes a native binary from multiple obfuscated URLs without user consent or verification. The package masquerades as a UI component but acts as a dropper for remote code execution. It uses evasion techniques such as splitting hostnames to avoid detection and disguises the downloaded files as diagnostic artifacts. There is no known patch or fix available for this malicious package.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'beaver-ui-multi-select-with-all' npm package version 35.6.4 is a malicious package that, when required, loads a loader script which selects a platform-specific URL from several Cloudflare Workers subdomains and fallback DNS-TXT chunked-base64 URLs to download an opaque native binary. This binary is saved to temporary directories with names resembling diagnostic tools and executed detached from the main process. The package attempts to frame this behavior as telemetry with opt-out environment variables, but by default performs unconditional remote code execution without hash or signature verification. The URLs are mutable and anonymous, increasing risk. The package's only observable behavior is this dropper activity, not UI functionality.
Potential Impact
This package enables unconditional remote code execution on the host system when imported, allowing an attacker to run arbitrary native code with the privileges of the executing process. The lack of verification and the use of anonymous mutable URLs increase the risk of malicious payload delivery. This can lead to system compromise, data theft, or further malware deployment.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should immediately remove 'beaver-ui-multi-select-with-all' version 35.6.4 from their projects and dependency trees. Avoid installing or importing this package. Use trusted sources and verify package integrity before installation. Monitor for any unexpected processes or files resembling the described behavior and investigate accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12818
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a738536bf8831d5394f0beb
Added to database: 08/05/2026, 18:47:18 UTC
Last enriched: 08/05/2026, 18:58:44 UTC
Last updated: 08/05/2026, 23:36:12 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.