beaver-ui-icon-lock

{"modified":"2026-08-05T09:30:28Z","published":"2026-08-05T08:53:07Z","schema_version":"1.7.4","id":"MAL-2026-12147","summary":"Malicious code in beaver-ui-icon-lock (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dc953ba45a243565fdc2ac41c733bfe5e4d09e9b9362325d2f670b39d1f84618)\nThe package's postinstall script setup.js selects a platform-specific asset path and fetches an executable from a list of Cloudflare Workers subdomains (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) whose hostnames are reassembled at runtime from split-string arrays such as [\"oob-wor\",\"ker.cf\",\"99-9b3.wor\",\"kers\",\".dev\"].join(\"\"). A DNS-TXT-over-*.well1.site fallback channel (tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, win.dl.well1.site) reconstructs a base64-encoded payload from numbered TXT records (c.<domain> for count, then i.<domain> chunks base64-decoded and concatenated). The fetched bytes are written to /tmp/.cache_<hex> or %TEMP%\\dotnet_diag_<hex>.exe, chmod 0o755 on POSIX, and launched with execFile(fp, [], { detached: true, stdio: [\"ignore\", out, out] }); child.unref() — output redirected to /dev/null and the child detached from the parent. No hash or signature verification is performed and the payload's purpose is unrelated to the package's stated visual-components function. index.js additionally contains try { require(\"./setup\"); } catch (_) {} at the bottom of the entrypoint, so requiring or importing beaver-ui-icon-lock re-runs the same fetch-and-execute chain (gated by a 6-hour stamp file) even when installs use --ignore-scripts. Cloudflare Workers subdomains and DNS-TXT-over-*.well1.site are attacker-controlled distribution infrastructure with no relationship to the package's declared publisher or purpose.\n","affected":[{"package":{"ecosystem":"npm","name":"beaver-ui-icon-lock"},"versions":["12.2.3","34.8.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"setup.js","sha256":"8f0408a8a36dac6c84b61ce497abe4e97fbec7aa75120b387894e005dff29ac7","tlsh":"17b1a4550afa71384392a1e8d92b5816b09fe5533284e990f34cb6985f97268c3b39fc"},{"path":"index.js","sha256":"3f688dd8dbcadbaff3d4d55f7d0cdaa520238821c5c084ceccc93def5db863b2","tlsh":"88f02b8515ebe87386b066e2de621082f66285254f4741547a8a60ef1eb0c140798eba"}],"package_integrity":[{"filename":"beaver-ui-icon-lock-34.8.3.tgz","hashes":{"sha1":"68fa80a6f17d772458faf37d9c3b3914b6d583ae","sha512_sri":"sha512-IEPZwk+kRdgA5K28d/2oVxcgcYRgBuT+fPqjr9NqaAefJdhQyb4uycHIFhF2TyRF9wgrDOa4mwD9T+Godtv8YQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/beaver-ui-icon-lock/v/12.2.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/beaver-ui-icon-lock/v/34.8.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014459","import_time":"2026-08-05T09:28:13.816495452Z","modified_time":"2026-08-05T08:53:33Z","sha256":"dc953ba45a243565fdc2ac41c733bfe5e4d09e9b9362325d2f670b39d1f84618","source":"amazon-inspector","versions":["12.2.3"]},{"id":"IN-MAL-2026-014456","import_time":"2026-08-05T09:28:13.22622593Z","modified_time":"2026-08-05T08:53:07Z","sha256":"e25d6e4259f8685805473a966f249a99e4883080f50396207f36f460bfeab073","source":"amazon-inspector","versions":["34.8.3"]}]}}