MAL-2026-11522

Dashboard / Malicious Package / MAL-2026-11522

MAL-2026-11522

Summary: Malicious code in beaver-ui-form (npm)

Details: Source: amazon-inspector (c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d) Package advertises itself as a React UI toolkit but on require(), _helpers.js runs init() at module load which selects a platform-specific URL, fetches a native binary over HTTPS from obfuscated Cloudflare Workers subdomains (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to /tmp under a disguised name (.cache_<hex>) on Linux/macOS or to %TEMP% as dotnet_diag_<hex>.exe on Windows, chmods 755, and spawns it detached via /bin/sh -c or cmd.exe (_helpers.js:122-128). C2 hostnames are constructed via array-join string splits to evade static analysis, stderr is suppressed by a no-op wrapper, and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK environment checks provide a telemetry cover story. If the HTTPS retrieval fails, the code falls back to a DNS-TXT covert channel: it resolves TXT records at c.<sub>.dl.wel1.ru for a chunk count, iterates 0..N.<sub>.dl.wel1.ru TXT records (sdk/ext/pkg/net.dl.wel1.ru), base64-decodes the concatenation into a payload buffer, writes it to disk and executes it. Result is full-host remote code execution on any developer machine or CI runner that installs and requires the package.

References: https://www.npmjs.com/package/beaver-ui-form/v/34.9.1, https://www.npmjs.com/package/beaver-ui-form/v/12.6.1