Malicious code in beaver-ui-card-large (npm)

The npm package beaver-ui-card-large was found to contain malicious code that executes automatically when the module is loaded. The package's index.js file requires setup.js, which schedules a bootstrap() function to run on process.nextTick, ensuring the payload executes during module initialization.

The bootstrap() function selects a platform-specific binary path (/pkg/package, /pkg/package-arm64, /pkg/loader_mac, /pkg/package.exe) and uses lib/telemetry.js to download the binary from a hardcoded pool of attacker-controlled Cloudflare Workers hosts (oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev) with DNS fallback to *.dl.well1.site subdomains (tin, tina, ldr, win). The downloaded binary is written to /var/tmp or %TEMP%, made executable (chmod 0755), and executed immediately.

To evade static analysis, the malicious code assembles host names, URLs, and OS API calls at runtime using split arrays and string concatenation (e.g., ['oob-wor','ker.cf','99-9b3.wor','kers','.dev'].join('')). The package falsely advertises itself as an Analytics SDK with a DISABLE_TELEMETRY environment variable as cover. During the fetch, setup.js builds an installer fingerprint from os.hostname(), os.userInfo().username, process.cwd(), process.version, and process.pid, passing this as installId with the request. There is no version pinning, signature verification, or hash validation of the downloaded content.