The 'beaver-ui-popover-card' npm package version 35.4.4 includes malicious functionality in its _support.js and lib/telemetry.js files. Upon require(), it downloads platform-specific binaries from dynamically assembled Cloudflare Workers hostnames with DNS TXT fallback resolvers unrelated to the package publisher. The binaries are saved under disguised names, made executable, and executed detached via shell commands without any integrity verification. Additionally, a second dropper embedded in telemetry.js uses runtime string concatenation and base64 decoding to hide its operations. Hostname obfuscation, covert DNS fallback, disguised filenames, and detached execution collectively confirm this package acts as a dropper malware.

This malicious package can execute arbitrary platform-specific binaries on the host system without user consent or verification, potentially leading to full system compromise or further malware deployment. The lack of signature or hash verification and the use of obfuscation techniques increase the risk of undetected execution. Any project that includes this package version risks executing untrusted code, which can lead to data theft, system disruption, or persistence of malicious payloads.

No official patch or remediation is currently documented. Users should immediately remove version 35.4.4 of 'beaver-ui-popover-card' from their projects and avoid using this package version. Consider auditing dependencies for this package and replacing it with a trusted alternative. Monitor for updates or advisories from the package publisher or security vendors for further remediation guidance. Since this is a malicious package, no legitimate fix is expected; removal and avoidance are the primary mitigations.