beaver-ui-ai-chat-layout

{"modified":"2026-08-05T08:55:07Z","published":"2026-08-05T08:55:07Z","schema_version":"1.7.4","id":"MAL-2026-12142","summary":"Malicious code in beaver-ui-ai-chat-layout (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c18143c270ff7461d38c50147f24245f346aecf7cc07e4883590c9c677b13809)\nPackage is advertised as a UI chat layout toolkit but its index.js unconditionally require()s a setup.js that side-loads a 77 KB module internally labelled 'Analytics SDK'. On require(), setup.js reads the installer's hostname, OS username, current working directory, Node.js version, and pid, derives a SHA-256 install fingerprint, and passes it to lib/telemetry.js, which issues https.request calls to an endpoint resolved at runtime via DNS-based service discovery rather than a hardcoded hostname. Sensitive OS APIs are accessed via runtime string concatenation (os['host'+'name'](), os['user'+'Info']().username, os['plat'+'form'](), os['ar'+'ch']()) to evade static detection. There is no opt-in; telemetry defaults on and is only disableable via an undocumented DISABLE_TELEMETRY env var. The package's declared purpose (UI layout) does not correspond to any behavior in the shipped code, which is limited to a trivial no-op class plus the fingerprint beacon.\n","affected":[{"package":{"ecosystem":"npm","name":"beaver-ui-ai-chat-layout"},"versions":["0.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"56f1fc5a6fce6c48eb1b34a89a8e7d64d8540584f53f22c0977acaeaa3ac71b6","tlsh":"1361115c6ed135260194e3f92a6f804bc99245432ac8ba58be4fb3451f5413983bff6f"},{"path":"lib/telemetry.js","sha256":"eac4233f664fa380839d8492bf8f5b9e2eaf89969a29ebb2572f880df62ce553","tlsh":"6f735055526a642186b2b368df334107ff3685272603429dbafc82dc1fb972092a5ffd"}],"package_integrity":[{"filename":"beaver-ui-ai-chat-layout-0.0.1.tgz","hashes":{"sha1":"0ea78dd3ae913106adaeff5b95de39bbe3e08d88","sha512_sri":"sha512-1LUmmCwqqemtQskvXWtEwON2fbl3IRbR2SEipFxre29TPz4oEq9PvJRowqatVSPF7puewzqng5M1UC4GbluOjQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/beaver-ui-ai-chat-layout/v/0.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014470","import_time":"2026-08-05T09:28:15.583984697Z","modified_time":"2026-08-05T08:55:07Z","sha256":"c18143c270ff7461d38c50147f24245f346aecf7cc07e4883590c9c677b13809","source":"amazon-inspector","versions":["0.0.1"]}]}}