MAL-2026-12060

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/beaver-ui-card-large/MAL-2026-12060.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-12060

Published

2026-08-05T02:51:20Z

Modified

2026-08-05T03:20:46.360469398Z

Summary

Malicious code in beaver-ui-card-large (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4cddf97a67fa28e298f65b3f96b200109d5f15a8a6dde49b8bdd025e8052abf2)

Package advertises itself as a React UI component library but index.js requires./setup.js, which schedules bootstrap() on process.nextTick so the payload runs when the module is loaded. bootstrap() selects a platform-specific asset path (/pkg/package, /pkg/package-arm64, /pkg/loadermac, /pkg/package.exe) and invokes lib/telemetry.js run(...) to download the binary from a hardcoded pool of Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with a DNS fallback to *.dl.well1.site (tin/tina/ldr/win subdomains). The downloaded file is written to /var/tmp or %TEMP%, chmod'd to 0755, and executed. Host, URL, and OS API strings are assembled at runtime from split arrays (e.g. ['oob-wor','ker.cf','99-9b3.wor','kers','.dev'].join(''); os'plat'+'form'; fs'chmod'+'Sync') to evade static analysis, and the module is labeled 'Analytics SDK' with a DISABLETELEMETRY opt-out as cover. Alongside the fetch, setup.js builds an installer fingerprint from os.hostname(), os.userInfo().username, process.cwd(), process.version, and process.pid and passes it as installId with the request. There is no version pinning, no signature or hash check, and the fetched content bears no relation to the advertised React-component purpose.

Database specific

{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T02:51:20Z",
            "source": "amazon-inspector",
            "sha256": "38731afcbb9c018db0d25f75836b008a1449095be8394c18f29ae7edac36ebeb",
            "import_time": "2026-08-05T03:12:03.869419387Z",
            "id": "IN-MAL-2026-011957",
            "versions": [
                "12.4.3"
            ]
        },
        {
            "modified_time": "2026-08-05T02:51:27Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-011958",
            "import_time": "2026-08-05T03:12:03.981841596Z",
            "sha256": "7d9d4b12703a3b14142e90185f1ba4b25b029b3518716ac91ff2144e7890a274",
            "versions": [
                "9.6.4"
            ]
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T02:51:52Z",
            "sha256": "c8b060656291d2f3a3558e4ca8ea0fb178c57d3aab9fa124b7abc25face64646",
            "import_time": "2026-08-05T03:12:04.301432633Z",
            "id": "IN-MAL-2026-011961",
            "versions": [
                "9.6.5"
            ]
        },
        {
            "modified_time": "2026-08-05T02:51:44Z",
            "source": "amazon-inspector",
            "sha256": "4cddf97a67fa28e298f65b3f96b200109d5f15a8a6dde49b8bdd025e8052abf2",
            "import_time": "2026-08-05T03:12:04.203880018Z",
            "id": "IN-MAL-2026-011960",
            "versions": [
                "9.6.3"
            ]
        },
        {
            "modified_time": "2026-08-05T02:52:01Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-011962",
            "import_time": "2026-08-05T03:12:04.385805366Z",
            "sha256": "681290a6e583e89c3d7470d4c9d8202bdadba6da9719ca949309948a71dfdb80",
            "versions": [
                "9.6.2"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / beaver-ui-card-large

Package

Name: beaver-ui-card-large; View open source insights on deps.dev
Purl: pkg:npm/beaver-ui-card-large

Affected ranges

Affected versions

9.*

9.6.2

9.6.3

9.6.4

9.6.5

12.*

12.4.3

Database specific

indicators

{
    "package_integrity": [
        {
            "filename": "beaver-ui-card-large-12.4.3.tgz",
            "hashes": {
                "sha512_sri": "sha512-k+j/Q3Rh2Ke6Vd7R5UtDgPCKcXf7Et6l9SMvasJ/nTlI0RNFBlyeqgn2JtYr+tj+QWMyZ1APZ1fr1Fy3fQjOjw==",
                "sha1": "924c3a39c46ee3615af5db13a3caa517d18a1be9"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "17b1a4550afa71384392a1e8d92b5816b09fe5533284e990f34cb6985f97268c3b39fc",
            "sha256": "8f0408a8a36dac6c84b61ce497abe4e97fbec7aa75120b387894e005dff29ac7",
            "path": "setup.js"
        },
        {
            "tlsh": "c0f02b8655dbe47386b062e2ef625042f67284618f4751587ac960ef1fa4c2403d8eba",
            "sha256": "9816f01b3f45da78b8a8ed752b9aaf0260108b2697a50270511b4e80f5740b61",
            "path": "index.js"
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/beaver-ui-card-large/MAL-2026-12060.json"

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]