{"answers":{"affected":"1 open source package ship an affected version, including beaver-ui-form.","exploited":"There is no known exploitation of MAL-2026-11522 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-11522 is a malicious package in beaver-ui-form, published on 4 Aug 2026."},"fix_prompt":"MAL-2026-11522 is a malicious package: beaver-ui-form (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-11522/ (Markdown: https://insights.sbomify.com/MAL-2026-11522/index.md)","id":"MAL-2026-11522","markdown":"https://insights.sbomify.com/MAL-2026-11522/index.md","name":"MAL-2026-11522","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package advertises itself as a React UI toolkit but on require(), _helpers.js runs init() at module load which selects a platform-specific URL, fetches a native binary over HTTPS from obfuscated Cloudflare Workers subdomains (oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to /tmp under a disguised name (.cache_\u003chex\u003e) on Linux/macOS or to %TEMP% as dotnet_diag_\u003chex\u003e.exe on Windows, chmods 755, and spawns it detached via /bin/sh -c or cmd.exe (_helpers.js:122-128). C2 hostnames are constructed via array-join string splits to evade static analysis, stderr is suppressed by a no-op wrapper, and DISABLE_TELEMETRY/ANALYTICS_OPT_OUT/DO_NOT_TRACK environment checks provide a telemetry cover story. If the HTTPS retrieval fails, the code falls back to a DNS-TXT covert channel: it resolves TXT records at c.\u003csub\u003e.dl.wel1.ru for a chunk count, iterates 0..N.\u003csub\u003e.dl.wel1.ru TXT records (sdk/ext/pkg/net.dl.wel1.ru), base64-decodes the concatenation into a payload buffer, writes it to disk and executes it. Result is full-host remote code execution on any developer machine or CI runner that installs and requires the package.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in beaver-ui-form (npm)","id":"MAL-2026-11522","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"beaver-ui-form","purl":"pkg:npm/beaver-ui-form","source":"MAL-2026-11522"}],"products":null,"published":"2026-08-04","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-11522/"}