The 'beaver-ui-object-card' npm package (version 35.3.8) includes a malicious payload where its index.js loads an auxiliary script (_ext.js) that selects a platform-specific asset path and downloads an unsigned native binary from hardcoded Cloudflare Workers mirrors. The binary download uses a DNS TXT chunked-base64 fallback resolver and is saved to temporary directories with deceptive names (e.g., dotnet_diag_<hex>.exe on Windows or .cache_<hex> on Unix). The binary is then made executable (chmod 0755) and spawned detached via shell commands. The package attempts to evade detection by reconstructing destination hosts and resolver domains at runtime from split string arrays and by presenting a fake analytics SDK facade, including a non-functional telemetry disable environment variable and unreachable telemetry code. The binary is attacker-controlled, unsigned, and unrelated to the package's documented purpose, executing immediately upon import.

This malicious package can execute arbitrary native code on the host system without user consent or verification, potentially leading to full system compromise, data theft, or persistence of attacker-controlled software. The unsigned and unpinned binary execution increases the risk of undetected malicious activity. The obfuscation and deception techniques hinder detection by static analysis tools and defenders.

No official patch or remediation is currently documented. Users should avoid using version 35.3.8 of 'beaver-ui-object-card' and remove it from their environments if present. Monitor for any updates or advisories from the package maintainers or npm registry. Consider scanning for and removing the dropped binaries in temporary directories. Due to the lack of an official fix, manual removal and blocking of this package are recommended.