The beaver-ui-smart-filter npm package (version 35.1.9) masquerades as a React UI filter component but includes malicious behavior. When its index.js is required, it loads an adapter script that constructs remote hostnames from fragments and attempts to download a platform-specific binary via HTTPS from these external hosts. The binary is saved to the system's temporary directory with a disguised filename (e.g., dotnet_diag_<hex>.exe on Windows) and executed in a detached shell process. A flag file named analytics_state is used to appear benign, and the presence of a DISABLE_TELEMETRY environment variable suppresses the binary drop to evade detection during review. The remote hosts are not affiliated with the package publisher, and no cryptographic verification of the downloaded binary is performed, allowing arbitrary code execution on the installer's machine.

This malicious package enables remote code execution on the machine installing or requiring it by downloading and running an unverified binary from attacker-controlled infrastructure. This can lead to full system compromise, persistence, and evasion of detection. The lack of integrity checks and the use of environment variables to suppress telemetry increase the risk of stealthy exploitation.

No official patch or remediation is currently documented. Users should avoid installing or using beaver-ui-smart-filter version 35.1.9. Verify package integrity and source before installation. Consider removing the package from existing environments and scanning for the presence of the malicious binary in temporary directories. Monitor for environment variables like DISABLE_TELEMETRY that may indicate attempts to suppress detection. Check vendor advisories or npm security advisories for updates or official fixes.