MAL-2026-12817 Malicious code in beaver-ui-list (npm)

On require('beaver-ui-list'), index.js loads ext.js, which selects a payload path based on OS and architecture, downloads a native binary from hardcoded Cloudflare Workers hosts (oob-worker.cf102-baf.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev) with a DNS-TXT chunked fallback to *.dl.wel1.ru, writes it to /tmp or %TEMP% under a disguised name (.cache<hex> on Unix, dotnet_diag_<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh or cmd. Host and domain literals are assembled at runtime from split-string arrays joined with.join("") to defeat static inspection, and a.analytics_state marker file plus a check of DISABLE_TELEMETRY / ANALYTICS_OPT_OUT / DO_NOT_TRACK environment variables provide a telemetry cover story. The package advertises itself as a UI component library; the payload delivery and execution have no relationship to that purpose and grant arbitrary code execution on the installer's host on module load.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.