MAL-2026-13603

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/platform-ui-colors/MAL-2026-13603.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13603
Published
2026-08-07T12:31:00Z
Modified
2026-08-07T13:20:57.575068708Z
Summary
Malicious code in platform-ui-colors (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (118252cd198a6c0e985917992969dbbaf8e9792ccbc27fab0ebbab191a1e6023)

On require of platform-ui-colors, both the declared main lib/telemetry.js and helpers.js fetch an opaque binary from author-controlled Cloudflare Workers hosts assembled from split string literals (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback to *.dl.wel1.ru, write it to /tmp/.cache<uid> or %TEMP%\dotnetdiag<uid>.exe, chmod 755 the file, and detached-spawn it via cp.spawn('/bin/sh', ['-c', filePath+' &'], {detached:true}). Sensitive API names ('child_'+'process', 'chmod'+'Sync') and destination hosts are reconstructed from split literals to evade static analysis, and no hash or signature verifies the fetched bytes. Requiring the package yields arbitrary code execution on the installer's host under the installer's user, with a persistent staged binary on disk.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-07T12:31:00Z",
            "id": "IN-MAL-2026-017012",
            "import_time": "2026-08-07T12:51:22.128613507Z",
            "versions": [
                "35.8.1"
            ],
            "source": "amazon-inspector",
            "sha256": "118252cd198a6c0e985917992969dbbaf8e9792ccbc27fab0ebbab191a1e6023"
        }
    ]
}
References
Credits

Affected packages

npm / platform-ui-colors

Package

Name
platform-ui-colors
View open source insights on deps.dev
Purl
pkg:npm/platform-ui-colors

Affected ranges

Affected versions

35.*
35.8.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "platform-ui-colors-35.8.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-ED39KI3b3yjqNemzyWtqigKsvSaxblWViX0sCKzNrU/E0qulm3U7q4jNfyKley4ugYvPX2BRg31BOifVCncvcQ==",
                "sha1": "18dfb240a26fb985a797684c4383df28b8492356"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "_helpers.js",
            "tlsh": "6fa1b65a26fa30180792e5d8891f5816719afa533385d8c4ff0c66945fd727883b29ec",
            "sha256": "0121e830aa822c7257e9dafb2d116d8f05d5e948bc7e7b2750564be7736c0f0e"
        },
        {
            "path": "lib/telemetry.js",
            "tlsh": "c2733f4966fb10214263b0685ebb40437635c4072a4eed5dba9c43ec9f8db3896f1fb9",
            "sha256": "fa261ee795326f5f8b726c79857f05a97a4a54b854841eee0026ef1803e77ede"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/platform-ui-colors/MAL-2026-13603.json"