What does the beaver-ui-hooks malware do?

The package's declared main (index.js) unconditionally loads _ext.js, which on require fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to a temporary path under hidden filenames (.cache_ on Unix, dotnet_diag_ .exe on Windows), sets executable permissions via fs.chmodSync(path, 0o755), and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) or cmd. When HTTPS fetch fails, _ext.js falls back to DNS TXT resolution against *.dl.wel1.ru (sdk., ext., pkg., net.), reassembling base64 chunks from the TXT records into a Buffer a

Which versions of beaver-ui-hooks are malicious?

The following npm versions of beaver-ui-hooks are flagged malicious: 12.6.3, 34.4.2. Treat any of these as compromised.

How do I remediate beaver-ui-hooks if I installed it?

Remove beaver-ui-hooks from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed beaver-ui-hooks — how do I know if it already compromised me?

If beaver-ui-hooks was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is beaver-ui-hooks part of a known attack campaign?

Yes — beaver-ui-hooks is associated with the IN-MAL-2026-014461, IN-MAL-2026-014464 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find beaver-ui-hooks across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for beaver-ui-hooks (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging beaver-ui-hooks across your stack and pipelines.

Malicious package

beaver-ui-hooksnpm

beaver-ui-hooks is a confirmed malicious npm package (MAL-2026-12146) that executes malicious code on install (malicious versions 12.6.3, 34.4.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in beaver-ui-hooks (npm)

MAL-2026-12146

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall beaver-ui-hooks

What this malware does

The package's declared main (index.js) unconditionally loads ext.js, which on require fetches a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev), writes it to a temporary path under hidden filenames (.cache<hex> on Unix, dotnet_diag_<hex>.exe on Windows), sets executable permissions via fs.chmodSync(path, 0o755), and spawns it detached via cp.spawn("/bin/sh", ["-c", fp+" &"], {detached:true}) or cmd. When HTTPS fetch fails, _ext.js falls back to DNS TXT resolution against *.dl.wel1.ru (sdk., ext., pkg., net.), reassembling base64 chunks from the TXT records into a Buffer and executing it — a covert channel designed to bypass HTTPS egress filtering. Destination hostnames and sensitive API names (child_process, chmodSync) are reconstructed at runtime from split string arrays to defeat static analysis. Cover-story comments frame the behavior as telemetry/analytics; the actual behavior is opaque, unpinned, unverified remote code execution on require of a package advertised as a UI hooks toolkit.

Malicious versions

2 flagged

12.6.334.4.2

Indicators of compromise (SHA-256)

86ba5710d957735b0f3fde73e6b6ba99347296b8dc992db5f1807924f3ffc139

b87cfe40dd30fac02d32f1b290dba2de7fb3747ef0ea939d594502e785457ee5

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for beaver-ui-hooks (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging beaver-ui-hooks across your stack and pipelines.
If you installed it — respond
Remove beaver-ui-hooks from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If beaver-ui-hooks was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks beaver-ui-hooks before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. beaver-ui-hooks on npm has been identified as a malicious package (versions 12.6.3, 34.4.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-014461IN-MAL-2026-014464

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks beaver-ui-hooks-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database