beaver-ui-breadcrumbs

{"modified":"2026-08-05T09:30:28Z","published":"2026-08-05T08:52:53Z","schema_version":"1.7.4","id":"MAL-2026-12143","summary":"Malicious code in beaver-ui-breadcrumbs (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d4d5ebbbd036f50f2c29c885260a8b513897fcae3614f714585723f45ad492cd)\nOn require() of the package, index.js loads _compat.js which selects a platform-specific endpoint from an obfuscated host list, downloads an opaque binary from Cloudflare Workers-hosted URLs (with a DNS TXT base64 fallback channel), writes it to /var/tmp or %TEMP% under a disguised name such as dotnet_diag_<hex>.exe or.cache_<hex>, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start /b. Hostnames and dangerous API names are constructed at runtime by joining split string arrays (e.g. reassembling 'oob-worker.cf...workers.dev' and require('child_'+'process'), fs['chmod'+'Sync']) to evade static analysis. The package is advertised as a UI breadcrumbs library and has no legitimate need to fetch and execute native code. A parallel dropper implementation is also shipped in lib/telemetry.js (81KB, framed as an 'Analytics SDK') with endpoint rotation, DNS-based service discovery, base64-decoded payload, and /bin/sh spawn; it is not reached from index.js in this version but is staged in the tarball.\n","affected":[{"package":{"ecosystem":"npm","name":"beaver-ui-breadcrumbs"},"versions":["33.1.6","0.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_compat.js","sha256":"9df983983dd772dd2582bde4ed2462feecbb1262c303e55e872eca1712159d8b","tlsh":"0da1a79a16a971198bb0dbe487178415f65bf6633380c294fb9ca9885f731248372efc"}],"package_integrity":[{"filename":"beaver-ui-breadcrumbs-33.1.6.tgz","hashes":{"sha1":"87b5e14fa6d3bd58ff6808c8d16e678fee80fe6f","sha512_sri":"sha512-Y2EhCivbylN+L70yZxCwhdEYRv6f5vOJV8AWzxkNtBJ4dMdJnxK/J5ex6W7AFFEzpn+dZpy33VyOcV/hGL/aAw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/beaver-ui-breadcrumbs/v/33.1.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/beaver-ui-breadcrumbs/v/0.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014454","import_time":"2026-08-05T09:28:12.966917081Z","modified_time":"2026-08-05T08:52:53Z","sha256":"a9d1032ebbf7a1d4822db515b34988c17e9331f1f82360f9912788fcd683acc8","source":"amazon-inspector","versions":["33.1.6"]},{"id":"IN-MAL-2026-014458","import_time":"2026-08-05T09:28:13.562521471Z","modified_time":"2026-08-05T08:53:26Z","sha256":"d4d5ebbbd036f50f2c29c885260a8b513897fcae3614f714585723f45ad492cd","source":"amazon-inspector","versions":["0.0.2"]}]}}