MAL-2026-12143

Dashboard / Malicious Package / MAL-2026-12143

MAL-2026-12143

Summary: Malicious code in beaver-ui-breadcrumbs (npm)

Details: Source: amazon-inspector (d4d5ebbbd036f50f2c29c885260a8b513897fcae3614f714585723f45ad492cd) On require() of the package, index.js loads _compat.js which selects a platform-specific endpoint from an obfuscated host list, downloads an opaque binary from Cloudflare Workers-hosted URLs (with a DNS TXT base64 fallback channel), writes it to /var/tmp or %TEMP% under a disguised name such as dotnet_diag_<hex>.exe or.cache_<hex>, chmods it 0755, and spawns it detached via /bin/sh -c or cmd /c start /b. Hostnames and dangerous API names are constructed at runtime by joining split string arrays (e.g. reassembling 'oob-worker.cf...workers.dev' and require('child_'+'process'), fs['chmod'+'Sync']) to evade static analysis. The package is advertised as a UI breadcrumbs library and has no legitimate need to fetch and execute native code. A parallel dropper implementation is also shipped in lib/telemetry.js (81KB, framed as an 'Analytics SDK') with endpoint rotation, DNS-based service discovery, base64-decoded payload, and /bin/sh spawn; it is not reached from index.js in this version but is staged in the tarball.

References: https://www.npmjs.com/package/beaver-ui-breadcrumbs/v/33.1.6, https://www.npmjs.com/package/beaver-ui-breadcrumbs/v/0.0.2