Skip to content
supplychainattack.orgSupply chain attack incident catalog
resolvedcritical

Malicious code in platform-ui-colors (npm)

The npm package platform-ui-colors contained malicious code that executed arbitrary binaries fetched from attacker-controlled Cloudflare Workers hosts on package installation. The malware persisted to disk and ran under the installer's user privileges.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any developer or system that installed the malicious platform-ui-colors package during the compromise window.
Ecosystems
npm
Attack vectors
Compromised package
Affected entities
  • platform-ui-colorsnpm package containing malicious code

The npm package platform-ui-colors was found to contain malicious code that triggered on require. The package's main entry points (lib/telemetry.js and helpers.js) fetched an opaque binary from author-controlled Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback to *.dl.wel1.ru.\n\nThe fetched binary was written to /tmp/.cache on Unix systems or %TEMP%\dotnet_diag_.exe on Windows, made executable via chmod 755, and then spawned as a detached process. The malware used obfuscation techniques including split string literals to reconstruct sensitive API names ('child_'+'process', 'chmod'+'Sync') and destination hosts to evade static analysis.\n\nNo cryptographic verification (hash or signature) was performed on the fetched bytes, allowing arbitrary code execution on the installer's host under the installer's user privileges. The staged binary persisted on disk, enabling post-installation compromise.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository (MAL-2026-13603).

Indicators of compromise

Packages
  • platform-ui-colors
Domains
  • oob-worker.cf100-416.workers.dev
  • oob-worker.cf101-adf.workers.dev
  • oob-worker.cf102-baf.workers.dev
  • dl.wel1.ru

Remediation

  • Remove the platform-ui-colors package from all projects and dependencies
  • Audit systems where platform-ui-colors was installed for unauthorized binaries in /tmp/.cache_ or %TEMP%\dotnet_diag_.exe
  • Review process execution logs for suspicious detached spawned processes during the installation window
  • Regenerate any credentials or secrets that may have been exposed on affected systems
  • Update to a patched version of platform-ui-colors if available, or use an alternative package
  • Monitor for outbound connections to the identified malicious domains (oob-worker.cf*.workers.dev, *.dl.wel1.ru)

Sources

  1. GitHub Advisory GHSA-p3jx-3fvm-5297 · GitHub Advisory Database

Cite this entry

"Malicious code in platform-ui-colors (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-platform-ui-colors-npm-1tjxxb

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. resolvedcritical

    Malicious code in autbank-core (npm)

    The npm package autbank-core contained malicious preinstall and postinstall lifecycle hooks that exfiltrated environment variables, credentials, and system information to a hardcoded webhook.site endpoint during installation.

    npmCompromised package
  2. resolvedcritical

    Malicious code in adxaa (npm)

    The npm package adxaa contained obfuscated malicious JavaScript designed to target users of a specific WordPress site. The payload exfiltrates session data, deletes accounts, and hijacks credentials via email overwrite and password reset.

    npmCompromised package
  3. resolvedcritical

    Malicious code in upload-to-gcp (npm)

    upload-to-gcp@3.2.1 (npm) contains malicious code in its postinstall script that exfiltrates host identifiers to an attacker-controlled endpoint. The package masquerades as a Google Cloud Platform utility but performs unauthorized telemetry collection at install time.

    npmCompromised package
  4. resolvedcritical

    Malicious code in akamai-sensor (npm)

    A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.

    npmCompromised packageTyposquatting