MAL-2026-12053

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tui-react-mobile-styles/MAL-2026-12053.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12053
Published
2026-08-05T01:33:55Z
Modified
2026-08-05T01:49:55.646295033Z
Summary
Malicious code in tui-react-mobile-styles (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (30d6926a3b8c5bc55e60b4d4f98b2e06fb6c04608bb9442058516814dfb54f1b)

The package presents itself as a React Native/mobile UI styles library but at module load time performs a full binary dropper chain. index.js require()s./shim, which runs an init() at module load that reconstructs destination hostnames from split string fragments to yield oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf100-416.workers.dev, plus a DNS-TXT chunked-base64 fallback path over *.dl.well1.site for environments blocking HTTPS. shim.js downloads a platform-specific payload, writes it to /var/tmp (or %TEMP%) under cover-story filenames (.cache<hex> on Unix, dotnetdiag<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd /c start /b. lib/telemetry.js contains the same drop-and-exec primitives (base64 chunk assembly, chmod 0755, detached /bin/sh spawn), with API names split (require("child" + "process"), fs["chmod" + "Sync"]) to defeat static analysis. The behavior has no relation to the package's stated UI-styles purpose and grants full-host code execution to whoever controls the Workers endpoints on any machine that installs or requires this package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-011503",
            "import_time": "2026-08-05T01:39:31.905581422Z",
            "versions": [
                "20.8.7"
            ],
            "modified_time": "2026-08-05T01:33:55Z",
            "sha256": "30d6926a3b8c5bc55e60b4d4f98b2e06fb6c04608bb9442058516814dfb54f1b",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / tui-react-mobile-styles

Package

Name
tui-react-mobile-styles
View open source insights on deps.dev
Purl
pkg:npm/tui-react-mobile-styles

Affected ranges

Affected versions

20.*
20.8.7

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "_shim.js",
            "tlsh": "a1a1a75a166571198b709be886174415f66be6a33780c2d0f79c98884f7613883b2dfc",
            "sha256": "b01b389003907b76364e551c10359315cba3b7d64812685971b5ac6c6aa5c33a"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "5b835055566a242186b2b368df234107ff3685272643429dbafc82dc1fbd72092a5ffc",
            "sha256": "9d06ed00d7565d44b89c2fef98dec57393f7251f1dc3c280cd24c3b06be8a7ab"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-7UvkzJs9b49KNXuR9juEhJhRE5V6A94jOGGCAom4cQicaTj3Ryd3Qs/wZ7mWd1Qybo4jg5fgYdLr+iBrMwUC7A==",
                "sha1": "2f49e46e377f4100737f34c53e66e2b0864c2cea"
            },
            "filename": "tui-react-mobile-styles-20.8.7.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/tui-react-mobile-styles/MAL-2026-12053.json"