Malicious code in platform-ui-island (npm)

The npm package platform-ui-island was found to contain malicious code in its index.js and lib/telemetry.js files. Upon require, the package unconditionally loads bridge.js, which initiates download of platform-specific native binaries from obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev). Domain names are assembled at runtime via string concatenation to evade plaintext scanning.\n\nThe downloaded payload is written to deceptive paths (dotnet_diag.exe on Windows, /var/tmp/.cache_ on Unix), marked executable (chmod 0755), and spawned detached via /bin/sh or cmd. When HTTPS fails, the dropper reconstructs the payload from base64-encoded chunks retrieved via DNS TXT queries to *.dl.well1.site subdomains (tin/tina/ldr/win.dl.well1.site), also obfuscated via string concatenation, and executes it using the same chmod+spawn mechanism—a covert channel designed to bypass HTTPS egress filtering.\n\nThe malicious code is framed with cover-story comments ("Shuffle endpoints to distribute load", "Cache validation") and a persistence flag file named .analytics_state to disguise the dropper as telemetry. A secondary loader with identical fetch/decode/chmod/spawn primitives (81 KB) is present in lib/telemetry.js, framed as an Analytics SDK but not referenced in the current version. The package is advertised as visual UI components, which has no legitimate reason to fetch or execute native binaries.