The beaver-ui-split-view npm package (version 35.1.2) includes code in its index.js that loads _bootstrap.js, which dynamically reconstructs hostnames to fetch opaque binary payloads over HTTPS from Cloudflare Workers domains. These payloads are saved to temporary directories with cover-story filenames, given executable permissions (chmod 0755), and executed detached from the parent process using shell commands. The package does not verify the integrity or authenticity of these binaries. Additionally, a ~81KB telemetry.js file contains a structurally identical dormant payload capable of similar behavior. The use of split-string reconstruction for hostnames and child_process module names is a deliberate evasion technique against static scanners. According to the GHSA advisory, any system with this package installed or running should be considered fully compromised, requiring immediate secret/key rotation and package removal, though removal may not fully eliminate the compromise.

Systems with the beaver-ui-split-view package version 35.1.2 installed or running are at high risk of full compromise. The malicious code downloads and executes arbitrary binaries without verification, potentially allowing attackers to execute arbitrary code with the privileges of the running process. This can lead to complete system takeover, unauthorized access to secrets and keys, and persistent malicious presence. The advisory states that all secrets and keys stored on the compromised system should be rotated immediately from a different, secure system. Removal of the package alone may not remove all malicious software introduced by the compromise.

No official patch or fix is currently available for this malicious package. Immediate removal of the beaver-ui-split-view package version 35.1.2 is strongly recommended. Systems with this package installed or running should be considered fully compromised. All secrets, keys, and credentials stored on the affected system must be rotated immediately from a secure, uncompromised environment. Due to the nature of the compromise, further forensic analysis and remediation may be necessary to ensure complete removal of malicious artifacts. Monitor for any suspicious activity related to this package and avoid using it in any environment.