Malicious code in platform-ui-codemods (npm)
The npm package platform-ui-codemods contained malicious code that acts as a staged remote-code-execution dropper. On require(), the package downloads and executes platform-specific binaries from obfuscated Cloudflare Workers mirrors or via DNS-TXT covert channels, with automatic execution on install/require.
- Disclosed
- Last updated
- Blast radius
- All systems that installed or required the malicious platform-ui-codemods package
- Ecosystems
- Attack vectors
- Affected entities
- platform-ui-codemodsnpm package containing malicious code
The npm package platform-ui-codemods was found to contain malicious code that executes automatically when the package is required. The attack chain begins with index.js loading a hidden compat module that initiates a download sequence.\n\nThe malware fetches platform-specific binaries from dynamically-constructed Cloudflare Workers hostnames (e.g., oob-worker.cf1*.workers.dev) assembled at runtime from split-string arrays. A DNS-TXT covert-channel fallback reconstructs base64 payloads from chunked TXT records under c.*.dl.well1.site subdomains (tin/tina/ldr/win variants).\n\nThe downloaded bytes are written to hidden/decoy paths—"/tmp/.cache_" on Unix or "%TEMP%\dotnet_diag_.exe" on Windows—marked executable (chmod 0755), and spawned detached via /bin/sh -c or cmd.exe. A cooldown stamp file (".analytics_state") prevents re-execution. The combination of hostname obfuscation, decoy filenames, DNS-TXT egress fallback, and detached execution indicates a sophisticated staged RCE dropper.\n\nThe malicious package was identified by the OpenSSF malicious-packages project (MAL-2026-12041).
Indicators of compromise
- Packages
- platform-ui-codemods
- Domains
- oob-worker.cf1*.workers.dev
- *.dl.well1.site
Remediation
- Immediately uninstall platform-ui-codemods from all systems and projects
- Audit npm install logs and dependency trees to identify all affected installations
- Scan systems for the presence of hidden files/executables in /tmp/.cache_* (Unix) or %TEMP%\dotnet_diag_* (Windows)
- Review process execution logs for detached shell/cmd.exe spawns originating from Node.js
- Check DNS query logs for requests to *.dl.well1.site domains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update to a patched version of platform-ui-codemods if available, or replace with an alternative package
- Implement package integrity verification and supply-chain security scanning in CI/CD pipelines
Sources
- GitHub Advisory GHSA-jpjf-h9c6-gh26 · GitHub Advisory Database
Cite this entry
"Malicious code in platform-ui-codemods (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-platform-ui-codemods-npm-9p098q
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in sme-rko-finance-front-operations-feed-impl (npm)
The npm package sme-rko-finance-front-operations-feed-impl contained malicious code that downloads and executes platform-specific binary payloads via Cloudflare Workers or DNS-based staging channels. The malware obfuscates child_process imports and executes on require(), making it active upon installation.
npmCompromised package - containedcritical
Malicious code in sme-rko-finance-front-operations-overnight (npm)
The npm package sme-rko-finance-front-operations-overnight contains malicious code that downloads and executes attacker-controlled binaries from Cloudflare Workers hosts on package require. The payload uses obfuscation techniques to evade static analysis and includes environment-based gating to reduce detection.
npmCompromised package - containedcritical
Malicious code in sme-rko-finance-front-payment-registers-operations-domain (npm)
The npm package sme-rko-finance-front-payment-registers-operations-domain contained malicious code that downloads and executes platform-specific binaries from attacker-controlled infrastructure. The package uses obfuscated string construction to hide command-and-control domains and implements a DNS-TXT fallback channel for payload delivery.
npmCompromised package - resolvedcritical
Malicious code in sme-rko-finance-front-operations-providers (npm)
The npm package sme-rko-finance-front-operations-providers contained malicious code that downloads and executes platform-specific binaries from attacker-controlled Cloudflare Workers subdomains and DNS-TXT fallback channels upon require().
npmCompromised package