MAL-2026-12141 Malicious code in beaver-ui-actions-button (npm)

The package is published as a React components library but ships no React code. On library load, index.js auto-requires setup.js, which constructs obfuscated hostnames via runtime string-concatenation — five Cloudflare Workers mirrors (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with tin/tina/ldr/win subdomains of dl.well1.site as DNS fallbacks — and per-OS asset paths (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe). lib/telemetry.js downloads the platform-specific binary, base64-decodes it, writes it to /var/tmp (or %TEMP% on Windows), applies mode 0755 via fs["chmod"+"Sync"], and executes it via require("child_"+"process"). Sensitive APIs (child_process, chmodSync, platform, hostname, userInfo, arch) and every destination hostname are assembled at runtime from split string fragments to evade static analysis. setup.js additionally computes a sha256 fingerprint over os.hostname, os.userInfo().username, process.cwd(), process.version, and process.pid, and transmits it as installId to the same Cloudflare Workers / dl.well1.site endpoints. Destinations are not publisher infrastructure, are not version-pinned, and are not hash- or signature-verified; the fetched binaries are attacker-controlled and their content can change at any time.