MAL-2026-11522 Malicious code in beaver-ui-form (npm)

Package advertises itself as a React UI toolkit but on require(), helpers.js runs init() at module load which selects a platform-specific URL, fetches a native binary over HTTPS from obfuscated Cloudflare Workers subdomains (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to /tmp under a disguised name (.cache<hex>) on Linux/macOS or to %TEMP% as dotnet_diag_<hex>.exe on Windows, chmods 755, and spawns it detached via /bin/sh -c or cmd.exe (_helpers.js:122-128). C2 hostnames are constructed via array-join string splits to evade static analysis, stderr is suppressed by a no-op wrapper, and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK environment checks provide a telemetry cover story. If the HTTPS retrieval fails, the code falls back to a DNS-TXT covert channel: it resolves TXT records at c.<sub>.dl.wel1.ru for a chunk count, iterates 0..N.<sub>.dl.wel1.ru TXT records (sdk/ext/pkg/net.dl.wel1.ru), base64-decodes the concatenation into a payload buffer, writes it to disk and executes it. Result is full-host remote code execution on any developer machine or CI runner that installs and requires the package.