MalwarePublished 5 Aug 2026

devplatform-spa-plugin-beaver (npm) · Malicious Code

Affects devplatform-spa-plugin-beaverSource GCVE Database

Malicious package : remove devplatform-spa-plugin-beaver and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 16:41 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12762

What to do

Remove devplatform-spa-plugin-beaver from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdevplatform-spa-plugin-beaver	Affected =35.2.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The devplatform-spa-plugin-beaver npm package version 35.2.2 contains malicious code that downloads and executes an opaque binary payload from obfuscated Cloudflare Workers URLs. The payload is saved to temporary system directories with disguised filenames and executed detached from the parent process. A DNS-TXT covert channel is used as a fallback communication method to bypass HTTP egress filtering. Execution is controlled to occur only once per host and can be disabled by specific environment variables. The fetched payload is unrelated to the package's advertised functionality and originates from suspicious domains outside the npm registry or vendor hosts.

Impact

The malicious payload execution can lead to unauthorized code execution on affected systems, potentially allowing attackers to run arbitrary binaries outside the npm ecosystem. The use of covert DNS channels and obfuscated download URLs complicates detection and network filtering. The payload runs with the privileges of the executing user and persists beyond the initial package require call, increasing the risk of stealthy compromise. There is no indication of direct data exfiltration or further payload capabilities from the provided data, but the capability to execute arbitrary code poses a significant security risk.

Defensive guidance

Users should immediately remove version 35.2.2 of devplatform-spa-plugin-beaver from their environments and avoid installing it. Employ strict package source verification and integrity checks to prevent installation of malicious packages. Monitor for presence of unexpected binaries in temporary directories and suspicious DNS TXT queries to the indicated domains.

Summary

The devplatform-spa-plugin-beaver package (version 35.2.2) includes malicious code in its _init.js file that, upon require(), dynamically constructs Cloudflare Workers hostnames to download an unsigned binary payload. This payload is stored in temporary directories with system-like filenames and executed detached from the parent process to persist beyond the require call. Additionally, a DNS-TXT record covert channel over specific subdomains provides a fallback method for payload delivery, circumventing HTTP egress filtering. The execution is gated by environment variables that opt out of telemetry and analytics, and a time-to-live marker ensures the payload executes only once per fresh host to reduce detection. The payload's source domains and behavior are inconsistent with legitimate npm package operations, indicating malicious intent.

References

npmjs.com/package/devplatform-spa-plugin-beaver/v/35.2.2 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 16:41 UTC

Technical details

References

Community reviews