beaver-ui-form

{"schema_version":"1.7.4","id":"MAL-2026-11522","published":"2026-08-04T21:12:52Z","modified":"2026-08-05T09:30:28.908529368Z","summary":"Malicious code in beaver-ui-form (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d)\nPackage advertises itself as a React UI toolkit but on require(), _helpers.js runs init() at module load which selects a platform-specific URL, fetches a native binary over HTTPS from obfuscated Cloudflare Workers subdomains (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to /tmp under a disguised name (.cache_<hex>) on Linux/macOS or to %TEMP% as dotnet_diag_<hex>.exe on Windows, chmods 755, and spawns it detached via /bin/sh -c or cmd.exe (_helpers.js:122-128). C2 hostnames are constructed via array-join string splits to evade static analysis, stderr is suppressed by a no-op wrapper, and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK environment checks provide a telemetry cover story. If the HTTPS retrieval fails, the code falls back to a DNS-TXT covert channel: it resolves TXT records at c.<sub>.dl.wel1.ru for a chunk count, iterates 0..N.<sub>.dl.wel1.ru TXT records (sdk/ext/pkg/net.dl.wel1.ru), base64-decodes the concatenation into a payload buffer, writes it to disk and executes it. Result is full-host remote code execution on any developer machine or CI runner that installs and requires the package.\n","affected":[{"package":{"name":"beaver-ui-form","ecosystem":"npm"},"versions":["34.9.1","12.6.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"5be1fa8072631a720b25a8b6b7a2833f8a2e2da3054eef5eb1750a94daddc901","tlsh":"44b1855a236a71188b70a7e0c7175425f65af6633781c1d4fb6ca9841fb712883b2efc"}],"package_integrity":[{"filename":"beaver-ui-form-34.9.1.tgz","hashes":{"sha1":"690686e55912a732ddd111e8dd5f2820c2eca4c8","sha512_sri":"sha512-Deycqy4nhuTK8djaYy3OOBSuNv7TsFlzlMIAGXeKdyJpwbl6h6gf0OSIWPFY2WW1B292rspqYj3pvYRGJqTE6Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/beaver-ui-form/v/34.9.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/beaver-ui-form/v/12.6.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010978","import_time":"2026-08-04T21:33:12.063629668Z","modified_time":"2026-08-04T21:12:52Z","sha256":"c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d","source":"amazon-inspector","versions":["34.9.1"]},{"id":"IN-MAL-2026-014463","import_time":"2026-08-05T09:28:14.583693792Z","modified_time":"2026-08-05T08:54:08Z","sha256":"f730a613c29fd6c66668d4cb7ff46e1f0dc41db9c33af96955df7f2d0b47585c","source":"amazon-inspector","versions":["12.6.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}