Malicious code in platform-ui-codemods (npm)
The npm package platform-ui-codemods contained malicious code that acts as a staged remote-code-execution dropper. On require(), the package downloads and executes platform-specific binaries from obfuscated Cloudflare Workers mirrors or via DNS-TXT covert channels, with automatic execution on install/require.
- Disclosed
- Last updated
- Blast radius
- All systems that installed or required the malicious platform-ui-codemods package
- Ecosystems
- Attack vectors
- Affected entities
- platform-ui-codemodsnpm package containing malicious code
The npm package platform-ui-codemods was found to contain malicious code that executes automatically when the package is required. The attack chain begins with index.js loading a hidden compat module that initiates a download sequence.\n\nThe malware fetches platform-specific binaries from dynamically-constructed Cloudflare Workers hostnames (e.g., oob-worker.cf1*.workers.dev) assembled at runtime from split-string arrays. A DNS-TXT covert-channel fallback reconstructs base64 payloads from chunked TXT records under c.*.dl.well1.site subdomains (tin/tina/ldr/win variants).\n\nThe downloaded bytes are written to hidden/decoy paths—"/tmp/.cache_" on Unix or "%TEMP%\dotnet_diag_.exe" on Windows—marked executable (chmod 0755), and spawned detached via /bin/sh -c or cmd.exe. A cooldown stamp file (".analytics_state") prevents re-execution. The combination of hostname obfuscation, decoy filenames, DNS-TXT egress fallback, and detached execution indicates a sophisticated staged RCE dropper.\n\nThe malicious package was identified by the OpenSSF malicious-packages project (MAL-2026-12041).
Indicators of compromise
- Packages
- platform-ui-codemods
- Domains
- oob-worker.cf1*.workers.dev
- *.dl.well1.site
Remediation
- Immediately uninstall platform-ui-codemods from all systems and projects
- Audit npm install logs and dependency trees to identify all affected installations
- Scan systems for the presence of hidden files/executables in /tmp/.cache_* (Unix) or %TEMP%\dotnet_diag_* (Windows)
- Review process execution logs for detached shell/cmd.exe spawns originating from Node.js
- Check DNS query logs for requests to *.dl.well1.site domains
- Regenerate any credentials or secrets that may have been exposed on affected systems
- Update to a patched version of platform-ui-codemods if available, or replace with an alternative package
- Implement package integrity verification and supply-chain security scanning in CI/CD pipelines
Sources
- GitHub Advisory GHSA-jpjf-h9c6-gh26 · GitHub Advisory Database
Cite this entry
"Malicious code in platform-ui-codemods (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-platform-ui-codemods-npm-9p098q
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @ai-vertical/ai-agent
Malware was discovered in the npm package @ai-vertical/ai-agent. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmAI agents & skillsCompromised package - containedcritical
Malicious code in gunzip-js (npm)
The npm package gunzip-js version 99.9.1 was identified as malicious by the OpenSSF Package Analysis project. The malicious version communicates with a domain associated with malicious activity.
npmCompromised package - resolvedcritical
Malicious code in adxaa (npm)
The npm package adxaa contained obfuscated malicious JavaScript designed to target users of a specific WordPress site. The payload exfiltrates session data, deletes accounts, and hijacks credentials via email overwrite and password reset.
npmCompromised package - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting