The beaver-ui-storybook-addon-code-description npm package version 35.7.7 includes a loader script that selects an OS-specific endpoint to download a binary payload from several hardcoded Cloudflare Workers domains. If this HTTPS download fails, it falls back to a DNS-TXT record covert channel to retrieve base64-encoded payload chunks, which it decodes and executes. The payload is written to temporary directories and executed detached from the main process. No hash or signature verification is performed, allowing arbitrary attacker-controlled code execution at package load time. The code uses obfuscation techniques such as runtime assembly of C2 hostnames and misleading variable names unrelated to the package's stated purpose.

This malicious package enables remote code execution on the machine of any user who installs or requires the affected version, allowing attackers to run arbitrary code with the privileges of the user. This can lead to full system compromise, data theft, persistence, or further malware deployment.

No official patch or remediation is currently documented. Users should immediately avoid installing or using version 35.7.7 of beaver-ui-storybook-addon-code-description. Audit existing environments for the presence of this package version and remove it. Monitor for updates from the package maintainer or npm advisories for any official fixes or guidance. Until a fix is available, do not trust this package version.