MAL-2026-12819 Malicious code in beaver-ui-object-card (npm)

On require('beaver-ui-object-card'), index.js loads ext.js which selects a platform-specific asset path and downloads an unsigned native binary from hardcoded Cloudflare Workers mirrors, with a DNS TXT chunked-base64 fallback resolver, then writes the binary to /var/tmp or %TEMP% under deceptive names (dotnet_diag<hex>.exe on Windows,.cache_<hex> on Unix), chmods it 0755, and spawns it detached via /bin/sh -c or cmd.exe /c start /b. Destination hosts and resolver domains are reassembled at runtime from split-string arrays (e.g. ["oob-worker.cf100-416.worker","s.de","v"].join("") and ['sdk.dl','.wel','1.r','u'].join("")) to defeat static analysis. A cover-story surrounds the dropper: an 'analytics_state' lock file, a DISABLE_TELEMETRY env gate that does not actually disable execution, a node-fetch/2.6 User-Agent, and an unreachable lib/telemetry.js presenting an 'Analytics SDK' facade. The delivered binary is attacker-controlled, unpinned, unsigned, mismatched to any documented package purpose, and executed detached on the installer's host at import time.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.