MAL-2026-11522

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/beaver-ui-form/MAL-2026-11522.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11522
Published
2026-08-04T21:12:52Z
Modified
2026-08-05T10:05:51.283621296Z
Summary
Malicious code in beaver-ui-form (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d)

Package advertises itself as a React UI toolkit but on require(), helpers.js runs init() at module load which selects a platform-specific URL, fetches a native binary over HTTPS from obfuscated Cloudflare Workers subdomains (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to /tmp under a disguised name (.cache<hex>) on Linux/macOS or to %TEMP% as dotnetdiag<hex>.exe on Windows, chmods 755, and spawns it detached via /bin/sh -c or cmd.exe (helpers.js:122-128). C2 hostnames are constructed via array-join string splits to evade static analysis, stderr is suppressed by a no-op wrapper, and DISABLETELEMETRY/ANALYTICSOPTOUT/DONOTTRACK environment checks provide a telemetry cover story. If the HTTPS retrieval fails, the code falls back to a DNS-TXT covert channel: it resolves TXT records at c.<sub>.dl.wel1.ru for a chunk count, iterates 0..N.<sub>.dl.wel1.ru TXT records (sdk/ext/pkg/net.dl.wel1.ru), base64-decodes the concatenation into a payload buffer, writes it to disk and executes it. Result is full-host remote code execution on any developer machine or CI runner that installs and requires the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010978",
            "import_time": "2026-08-04T21:33:12.063629668Z",
            "sha256": "c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d",
            "modified_time": "2026-08-04T21:12:52Z",
            "versions": [
                "34.9.1"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-014463",
            "import_time": "2026-08-05T09:28:14.583693792Z",
            "sha256": "f730a613c29fd6c66668d4cb7ff46e1f0dc41db9c33af96955df7f2d0b47585c",
            "modified_time": "2026-08-05T08:54:08Z",
            "versions": [
                "12.6.1"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / beaver-ui-form

Package

Name
beaver-ui-form
View open source insights on deps.dev
Purl
pkg:npm/beaver-ui-form

Affected ranges

Affected versions

12.*
12.6.1
34.*
34.9.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Deycqy4nhuTK8djaYy3OOBSuNv7TsFlzlMIAGXeKdyJpwbl6h6gf0OSIWPFY2WW1B292rspqYj3pvYRGJqTE6Q==",
                "sha1": "690686e55912a732ddd111e8dd5f2820c2eca4c8"
            },
            "filename": "beaver-ui-form-34.9.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "_helpers.js",
            "sha256": "5be1fa8072631a720b25a8b6b7a2833f8a2e2da3054eef5eb1750a94daddc901",
            "tlsh": "44b1855a236a71188b70a7e0c7175425f65af6633781c1d4fb6ca9841fb712883b2efc"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/beaver-ui-form/MAL-2026-11522.json"