registry / beaver-ui-drawer / 9.4.12

beaver-ui-drawer@9.4.12

UI drawer component for Beaver design system

AI Security Review

scanned 14d ago · by lpm-firewall-ai

npm postinstall silently retrieves and executes an unverified remote binary. It uses rotating obfuscated CDN-like hosts and a DNS TXT fallback, then detaches the payload.

Static reason

One or more suspicious static signals were detected.

Trigger

Installing beaver-ui-drawer@9.4.12.

Impact

Arbitrary native code execution as the installing user, with payload behavior controlled remotely.

Mechanism

postinstall remote payload download, temp-file drop, and detached execution

Attack narrative

On npm installation, package.json invokes setup.js. The script skips only telemetry opt-outs or a short-lived stamp, fetches a platform-specific binary from obfuscated remote hosts (or decodes one from DNS TXT), writes it to a temporary randomized path, marks it executable where needed, and launches it detached with output suppressed. This is an unconsented remote-code-execution chain unrelated to the declared UI component.

Rationale

Direct source inspection confirms a postinstall downloader/dropper/launcher chain with remote payload control. The package provides no legitimate implementation that would require executing an opaque native payload.

Evidence

package.jsonsetup.jsindex.jsREADME.md/tmp/.analytics_state/var/tmp/.cache_<random>%TEMP%\analytics_state%TEMP%\.dl_<random>%TEMP%\dotnet_diag_<random>.exe

Network endpoints9

/pkg/package

beaver-ui-drawer@9.4.12

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code