MAL-2026-12142
Dashboard / Malicious Package / MAL-2026-12142
MAL-2026-12142
Summary: Malicious code in beaver-ui-ai-chat-layout (npm)
Details: Source: amazon-inspector (c18143c270ff7461d38c50147f24245f346aecf7cc07e4883590c9c677b13809) Package is advertised as a UI chat layout toolkit but its index.js unconditionally require()s a setup.js that side-loads a 77 KB module internally labelled 'Analytics SDK'. On require(), setup.js reads the installer's hostname, OS username, current working directory, Node.js version, and pid, derives a SHA-256 install fingerprint, and passes it to lib/telemetry.js, which issues https.request calls to an endpoint resolved at runtime via DNS-based service discovery rather than a hardcoded hostname. Sensitive OS APIs are accessed via runtime string concatenation (os['host'+'name'](), os['user'+'Info']().username, os['plat'+'form'](), os['ar'+'ch']()) to evade static detection. There is no opt-in; telemetry defaults on and is only disableable via an undocumented DISABLE_TELEMETRY env var. The package's declared purpose (UI layout) does not correspond to any behavior in the shipped code, which is limited to a trivial no-op class plus the fingerprint beacon.
Affected packages
Package
Name: beaver-ui-ai-chat-layout
Purl: pkg:npm/beaver-ui-ai-chat-layout
Affected ranges
Type: N/A
Events:
