Malicious code in beaver-ui-object-card (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4a2a78be16248a4269fca22b39cf436f82f26818c797949af73eca331cc3a0f6) On require('beaver-ui-object-card'), index.js loads _ext.js which selects a platform-specific asset path and downloads an unsigned native binary from hardcoded Cloudflare Workers mirrors, with a DNS TXT chunked-base64 fallback resolver, then writes the binary to /var/tmp or %TEMP% under deceptive names (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Destination hosts and resolver domains are reassembled at runtime from split-string arrays (e.g. ["oob-worker.cf100-416.worker","s.de","v"].join("") and ['sdk.dl','.wel','1.r','u'].join("")) to defeat static analysis. A cover-story surrounds the dropper: an 'analytics_state' lock file, a DISABLE_TELEMETRY env gate that does not actually disable execution, a node-fetch/2.6 User-Agent, and an unreachable lib/telemetry.js presenting an 'Analytics SDK' facade. The delivered binary is attacker-controlled, unpinned, unsigned, mismatched to any documented package purpose, and executed detached on the installer's host at import time. ## Source: ghsa-malware (e5933354eabc23202d7e993aa70f3cb868291f3c49bc4a83bf4576718191c852) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The 'beaver-ui-object-card' npm package (version 35.3.8) includes a malicious payload where its index.js loads an auxiliary script (_ext.js) that selects a platform-specific asset path and downloads an unsigned native binary from hardcoded Cloudflare Workers mirrors. The binary download uses a DNS TXT chunked-base64 fallback resolver and is saved to temporary directories with deceptive names (e.g., dotnet_diag_<hex>.exe on Windows or .cache_<hex> on Unix). The binary is then made executable (chmod 0755) and spawned detached via shell commands. The package attempts to evade detection by reconstructing destination hosts and resolver domains at runtime from split string arrays and by presenting a fake analytics SDK facade, including a non-functional telemetry disable environment variable and unreachable telemetry code. The binary is attacker-controlled, unsigned, and unrelated to the package's documented purpose, executing immediately upon import.
Potential Impact
This malicious package can execute arbitrary native code on the host system without user consent or verification, potentially leading to full system compromise, data theft, or persistence of attacker-controlled software. The unsigned and unpinned binary execution increases the risk of undetected malicious activity. The obfuscation and deception techniques hinder detection by static analysis tools and defenders.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid using version 35.3.8 of 'beaver-ui-object-card' and remove it from their environments if present. Monitor for any updates or advisories from the package maintainers or npm registry. Consider scanning for and removing the dropped binaries in temporary directories. Due to the lack of an official fix, manual removal and blocking of this package are recommended.
Malicious code in beaver-ui-object-card (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4a2a78be16248a4269fca22b39cf436f82f26818c797949af73eca331cc3a0f6) On require('beaver-ui-object-card'), index.js loads _ext.js which selects a platform-specific asset path and downloads an unsigned native binary from hardcoded Cloudflare Workers mirrors, with a DNS TXT chunked-base64 fallback resolver, then writes the binary to /var/tmp or %TEMP% under deceptive names (dotnet_diag_<hex>.exe on Windows,.cache_<hex> on Unix), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Destination hosts and resolver domains are reassembled at runtime from split-string arrays (e.g. ["oob-worker.cf100-416.worker","s.de","v"].join("") and ['sdk.dl','.wel','1.r','u'].join("")) to defeat static analysis. A cover-story surrounds the dropper: an 'analytics_state' lock file, a DISABLE_TELEMETRY env gate that does not actually disable execution, a node-fetch/2.6 User-Agent, and an unreachable lib/telemetry.js presenting an 'Analytics SDK' facade. The delivered binary is attacker-controlled, unpinned, unsigned, mismatched to any documented package purpose, and executed detached on the installer's host at import time. ## Source: ghsa-malware (e5933354eabc23202d7e993aa70f3cb868291f3c49bc4a83bf4576718191c852) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'beaver-ui-object-card' npm package (version 35.3.8) includes a malicious payload where its index.js loads an auxiliary script (_ext.js) that selects a platform-specific asset path and downloads an unsigned native binary from hardcoded Cloudflare Workers mirrors. The binary download uses a DNS TXT chunked-base64 fallback resolver and is saved to temporary directories with deceptive names (e.g., dotnet_diag_<hex>.exe on Windows or .cache_<hex> on Unix). The binary is then made executable (chmod 0755) and spawned detached via shell commands. The package attempts to evade detection by reconstructing destination hosts and resolver domains at runtime from split string arrays and by presenting a fake analytics SDK facade, including a non-functional telemetry disable environment variable and unreachable telemetry code. The binary is attacker-controlled, unsigned, and unrelated to the package's documented purpose, executing immediately upon import.
Potential Impact
This malicious package can execute arbitrary native code on the host system without user consent or verification, potentially leading to full system compromise, data theft, or persistence of attacker-controlled software. The unsigned and unpinned binary execution increases the risk of undetected malicious activity. The obfuscation and deception techniques hinder detection by static analysis tools and defenders.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid using version 35.3.8 of 'beaver-ui-object-card' and remove it from their environments if present. Monitor for any updates or advisories from the package maintainers or npm registry. Consider scanning for and removing the dropped binaries in temporary directories. Due to the lack of an official fix, manual removal and blocking of this package are recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12819
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a738536bf8831d5394f0be4
Added to database: 08/05/2026, 18:47:18 UTC
Last enriched: 08/05/2026, 18:59:05 UTC
Last updated: 08/18/2026, 07:33:01 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.