Malicious code in beaver-ui-multi-select-with-all (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bbb4bab7b1c75e94cd3411aa312a1313e3d5a84bed77943b10f8c969b751cb23) On require() of the package's main entry, index.js loads _loader.js which selects a per-platform URL, downloads an opaque native binary from one of three Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT chunked-base64 fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The bytes are written to /tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe, chmod 0755, and spawned detached via /bin/sh -c or cmd /c start /b. Hostnames are assembled from split string arrays (e.g. ["oob-worker.cf99-9b3.wor","kers.","dev"].join("")) to evade substring scans, and file names (analytics_state, dotnet_diag) masquerade as diagnostics artifacts. A telemetry-styled opt-out gate (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) frames the download-and-execute as consented telemetry, but the default path is unconditional remote code execution. No hash or signature verification is performed; the URL is mutable and anonymous. The package name resembles a UI select component but its only observable behavior on import is the dropper. ## Source: ghsa-malware (9c3519c1c22bb4eab75836d741089a70981c2909eea8323132d4424fb338f929) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The 'beaver-ui-multi-select-with-all' npm package version 35.6.4 is a malicious package that, when required, loads a loader script which selects a platform-specific URL from several Cloudflare Workers subdomains and fallback DNS-TXT chunked-base64 URLs to download an opaque native binary. This binary is saved to temporary directories with names resembling diagnostic tools and executed detached from the main process. The package attempts to frame this behavior as telemetry with opt-out environment variables, but by default performs unconditional remote code execution without hash or signature verification. The URLs are mutable and anonymous, increasing risk. The package's only observable behavior is this dropper activity, not UI functionality.
Potential Impact
This package enables unconditional remote code execution on the host system when imported, allowing an attacker to run arbitrary native code with the privileges of the executing process. The lack of verification and the use of anonymous mutable URLs increase the risk of malicious payload delivery. This can lead to system compromise, data theft, or further malware deployment.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should immediately remove 'beaver-ui-multi-select-with-all' version 35.6.4 from their projects and dependency trees. Avoid installing or importing this package. Use trusted sources and verify package integrity before installation. Monitor for any unexpected processes or files resembling the described behavior and investigate accordingly.
Malicious code in beaver-ui-multi-select-with-all (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bbb4bab7b1c75e94cd3411aa312a1313e3d5a84bed77943b10f8c969b751cb23) On require() of the package's main entry, index.js loads _loader.js which selects a per-platform URL, downloads an opaque native binary from one of three Cloudflare Workers subdomains (oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), with a DNS-TXT chunked-base64 fallback via sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru. The bytes are written to /tmp/.cache_<rand> or %TEMP%\dotnet_diag_<rand>.exe, chmod 0755, and spawned detached via /bin/sh -c or cmd /c start /b. Hostnames are assembled from split string arrays (e.g. ["oob-worker.cf99-9b3.wor","kers.","dev"].join("")) to evade substring scans, and file names (analytics_state, dotnet_diag) masquerade as diagnostics artifacts. A telemetry-styled opt-out gate (DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK) frames the download-and-execute as consented telemetry, but the default path is unconditional remote code execution. No hash or signature verification is performed; the URL is mutable and anonymous. The package name resembles a UI select component but its only observable behavior on import is the dropper. ## Source: ghsa-malware (9c3519c1c22bb4eab75836d741089a70981c2909eea8323132d4424fb338f929) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'beaver-ui-multi-select-with-all' npm package version 35.6.4 is a malicious package that, when required, loads a loader script which selects a platform-specific URL from several Cloudflare Workers subdomains and fallback DNS-TXT chunked-base64 URLs to download an opaque native binary. This binary is saved to temporary directories with names resembling diagnostic tools and executed detached from the main process. The package attempts to frame this behavior as telemetry with opt-out environment variables, but by default performs unconditional remote code execution without hash or signature verification. The URLs are mutable and anonymous, increasing risk. The package's only observable behavior is this dropper activity, not UI functionality.
Potential Impact
This package enables unconditional remote code execution on the host system when imported, allowing an attacker to run arbitrary native code with the privileges of the executing process. The lack of verification and the use of anonymous mutable URLs increase the risk of malicious payload delivery. This can lead to system compromise, data theft, or further malware deployment.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should immediately remove 'beaver-ui-multi-select-with-all' version 35.6.4 from their projects and dependency trees. Avoid installing or importing this package. Use trusted sources and verify package integrity before installation. Monitor for any unexpected processes or files resembling the described behavior and investigate accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12818
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a738536bf8831d5394f0beb
Added to database: 08/05/2026, 18:47:18 UTC
Last enriched: 08/05/2026, 18:58:44 UTC
Last updated: 08/16/2026, 11:35:09 UTC
Views: 20
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.