Supply chain · npm · High

Critical Malicious npm Package 'beaver-ui-header' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-08-03

A critical malicious npm package, 'beaver-ui-header', has been identified, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately from a separate, secure machine, and the package removed.

  • Package: npm / beaver-ui-header
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~162/wk
  • Exposure: 70/100 (High)

What happened — Credential / secret theft

The npm package 'beaver-ui-header' contains malware that, upon installation, fully compromises the host computer. This allows an external entity to gain complete control over the system.

How the attack works

This is a supply-chain attack where a malicious package is introduced into a software ecosystem. When developers or automated systems integrate this package into their projects, the malicious code executes during installation or runtime, leading to unauthorized access and control of the compromised system. The specific mechanism of compromise is not detailed, but the outcome is full system control.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm packages
  • Any user or system that has directly or indirectly installed 'beaver-ui-header'

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest malicious version
  • Lack of lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Use of internal package mirrors that may not filter malicious packages
  • Automated builds that install dependencies without manual review

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets and keys stored on the compromised computer are exposed and potentially exfiltrated.
  • The compromised system can be used as a pivot point for further attacks within the network.
  • Persistence mechanisms may be established, making simple package removal insufficient for remediation.

What to do (defensive)

Detect

  • Review dependency trees for 'beaver-ui-header' in all projects.
  • Scan project dependencies using software composition analysis (SCA) tools.
  • Monitor network traffic for unusual outbound connections from development or build systems.

Contain

  • Immediately isolate any systems found to have 'beaver-ui-header' installed.
  • Block 'beaver-ui-header' from being downloaded or installed in your environment.
  • Suspend builds that rely on potentially compromised dependencies.

Remediate

  • Consider any system that installed 'beaver-ui-header' as fully compromised.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, credentials) that were stored on or accessible from the compromised computer, using a different, trusted machine.
  • Remove the 'beaver-ui-header' package from all affected projects and systems.
  • Rebuild compromised systems from trusted images or backups, as package removal alone may not eliminate all malicious software.

Frontier verdict — High

Prioritize immediate isolation, secret rotation, and system rebuild for any environment exposed to the critical 'beaver-ui-header' npm package.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.