Hostile 100% javascript Download

beaver-ui-form-object 12.1.7

Downloads and executes remote binary

Library import stages and detaches a fetched executablenpm entry import conceals a native payload sidecar
SHA-256af86b7d5cc4497ccd67eb32e8dc128f0c16db6add8913cf46b3948065bea239e
URLhttps://registry.npmjs.org/beaver-ui-form-object/-/beaver-ui-form-object-12.1.7.tgz
MaleculeK(Li)O₄(C₂S₅As₂Er)H₆(Cm₁₀CrDb₉F₆Os₈Po₁₁)Md₂(InPa)

Also flagged by osv (MAL-2026-12145: Malicious code in beaver-ui-form-object (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.