The beaver-ui-pagination npm package version 35.3.7 includes malicious functionality where requiring the package triggers loading of _init.js, which dynamically constructs hostnames to download a binary payload from multiple obfuscated domains. The payload is saved to temporary directories with disguised filenames, permissions are set to executable, and it is executed detached via shell commands. The code uses environment variables and marker files to masquerade the activity as telemetry data collection. A sibling telemetry.js file contains a second copy of the dropper code but is not currently reachable from the main entry point. No patch or remediation details are provided.

This malicious code allows arbitrary binary payloads to be downloaded and executed on the host system with the permissions of the running process. This can lead to full system compromise, persistence, and potential further malicious activity. The obfuscation and masquerading as telemetry may delay detection by users or automated systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using beaver-ui-pagination version 35.3.7 or any untrusted versions. Consider removing the package from projects and scanning for its presence in dependencies.