MAL-2026-12146

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/beaver-ui-hooks/MAL-2026-12146.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12146
Published
2026-08-05T08:53:53Z
Modified
2026-08-05T15:50:24.912572458Z
Summary
Malicious code in beaver-ui-hooks (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (86ba5710d957735b0f3fde73e6b6ba99347296b8dc992db5f1807924f3ffc139)

The package's declared main (index.js) unconditionally loads ext.js, which on require fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to a temporary path under hidden filenames (.cache<hex> on Unix, dotnetdiag<hex>.exe on Windows), sets executable permissions via fs.chmodSync(path, 0o755), and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) or cmd. When HTTPS fetch fails, ext.js falls back to DNS TXT resolution against *.dl.wel1.ru (sdk., ext., pkg., net.), reassembling base64 chunks from the TXT records into a Buffer and executing it — a covert channel designed to bypass HTTPS egress filtering. Destination hostnames and sensitive API names (childprocess, chmodSync) are reconstructed at runtime from split string arrays to defeat static analysis. Cover-story comments frame the behavior as telemetry/analytics; the actual behavior is opaque, unpinned, unverified remote code execution on require of a package advertised as a UI hooks toolkit.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T09:28:14.283608853Z",
            "modified_time": "2026-08-05T08:53:53Z",
            "sha256": "86ba5710d957735b0f3fde73e6b6ba99347296b8dc992db5f1807924f3ffc139",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014461",
            "versions": [
                "34.4.2"
            ]
        },
        {
            "import_time": "2026-08-05T09:28:14.749538022Z",
            "modified_time": "2026-08-05T08:54:16Z",
            "sha256": "b87cfe40dd30fac02d32f1b290dba2de7fb3747ef0ea939d594502e785457ee5",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014464",
            "versions": [
                "12.6.3"
            ]
        },
        {
            "modified_time": "2026-08-05T15:06:27Z",
            "source": "amazon-inspector",
            "sha256": "1e71ef9ce78034f187082deca25f97d033772fb7b3a14994af91863a2b106724",
            "import_time": "2026-08-05T15:19:58.36783206Z",
            "id": "IN-MAL-2026-015569",
            "versions": [
                "35.3.5"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / beaver-ui-hooks

Package

Name
beaver-ui-hooks
View open source insights on deps.dev
Purl
pkg:npm/beaver-ui-hooks

Affected ranges

Affected versions

12.*
12.6.3
34.*
34.4.2
35.*
35.3.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "beaver-ui-hooks-34.4.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-XL+Ok0gRruBi/RYoqkvcaYyKVldaGsltXa93d7euWMcMx6MBsXxUQGdcLprCo96hjwbg/1/ENhgf6wR9RwdT4A==",
                "sha1": "ce3ce2f5cf33b6d476891415503539688ca52b4c"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "18b17696066670194bb097e4cb1b9816fa5ff6633780c284fb5ca5845f76224c3b2efc",
            "sha256": "f5b9c3bbcdaab493894d1c5c8104c8a6dcae64ca51d812a72641c56dadf7d40c",
            "path": "_ext.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/beaver-ui-hooks/MAL-2026-12146.json"