The beaver-ui-side-navigation npm package version 35.7.1 is a malicious package that, when required or imported, loads a helper script which fetches a platform-specific opaque binary from attacker-controlled Cloudflare Workers domains and fallback DNS TXT records. The binary is saved to temporary directories under disguised filenames, permissions are set to executable, and it is executed detached via shell commands without any integrity checks. The package uses runtime string assembly to hide sensitive API calls such as child_process and chmodSync. Additional telemetry code attempts to mask the malicious behavior. The package name mimics a legitimate UI component but contains no UI code.

This malicious package can execute arbitrary code on the host system with the permissions of the user running the Node.js process. The dropped binary is opaque and attacker-controlled, potentially enabling a wide range of malicious activities including system compromise, data exfiltration, or persistence. The lack of signature verification and obfuscation techniques increase the risk of undetected compromise.

No official patch or remediation is currently documented. Users should immediately remove the beaver-ui-side-navigation package version 35.7.1 from their projects and replace it with a trusted alternative. Audit dependencies for this package and any related malicious code. Monitor for unusual process executions originating from Node.js environments. Check vendor advisories or trusted security sources for updates or fixes regarding this package.