The beaver-ui-subheader npm package (version 35.7.2) masquerades as a UI subheader component but includes malicious functionality. Upon loading, it requires a support script that downloads a platform-specific binary from dynamically assembled Cloudflare Workers hosts, using DNS TXT-record fallback to reassemble base64-encoded chunks from multiple domains. The binary is saved to temporary locations on Unix or Windows systems, given executable permissions, and executed detached from the main process. The package uses environment variables and a telemetry state file to gate this behavior and conceal its true intent. Such actions are not legitimate for a UI component library and indicate malicious intent.

This malicious package can execute arbitrary native code on the host system without user consent, potentially leading to system compromise, data theft, or further malware deployment. The obfuscation techniques and use of detached execution make detection and analysis more difficult. There are no known exploits in the wild reported yet.

No official patch or remediation is currently available. Users should immediately remove version 35.7.2 of beaver-ui-subheader from their projects and avoid using this package. Monitor for updates from the package maintainer or npm advisories for any official fixes or removals. Consider scanning existing environments for presence of this package and any suspicious binaries in temporary directories.