The beaver-ui-popover-marker npm package (version 35.5.8) includes malicious functionality triggered during the require() call. It loads a script that cycles through obfuscated Cloudflare Workers endpoints to download a platform-specific binary, which it writes to a hidden file in the system's temporary directory with a decoy name. The binary is then made executable and spawned detached via shell commands. If HTTPS fetches fail, a DNS TXT record fallback reconstructs a base64-encoded payload. The package pretends to be a React UI popover component but has no legitimate reason to fetch and execute native binaries, resulting in full host code execution on any machine that uses this package.

This malicious package grants full host code execution on any machine that installs or requires it, enabling an attacker to run arbitrary native code with the privileges of the user running the Node.js process. This can lead to complete system compromise, data theft, persistence, and further malicious activities.

No official patch or remediation is currently documented. Users should immediately avoid installing or requiring version 35.5.8 of beaver-ui-popover-marker. Remove the package from all environments and replace it with a trusted alternative. Monitor for any suspicious activity related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.