Malicious code in platform-ui-island (npm)
The npm package platform-ui-island contained malicious code that downloads and executes platform-specific native binaries from attacker-controlled infrastructure at require-time. The dropper uses obfuscated domain names, DNS TXT record fallback channels, and deceptive file paths to evade detection.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer of platform-ui-island; execution of arbitrary native binaries on Windows and Unix systems at require-time.
- Ecosystems
- Attack vectors
- Affected entities
- platform-ui-islandnpm package containing malicious dropper code
The npm package platform-ui-island was found to contain malicious code in its index.js and lib/telemetry.js files. Upon require, the package unconditionally loads bridge.js, which initiates download of platform-specific native binaries from obfuscated Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev). Domain names are assembled at runtime via string concatenation to evade plaintext scanning.\n\nThe downloaded payload is written to deceptive paths (dotnet_diag.exe on Windows, /var/tmp/.cache_ on Unix), marked executable (chmod 0755), and spawned detached via /bin/sh or cmd. When HTTPS fails, the dropper reconstructs the payload from base64-encoded chunks retrieved via DNS TXT queries to *.dl.well1.site subdomains (tin/tina/ldr/win.dl.well1.site), also obfuscated via string concatenation, and executes it using the same chmod+spawn mechanism—a covert channel designed to bypass HTTPS egress filtering.\n\nThe malicious code is framed with cover-story comments ("Shuffle endpoints to distribute load", "Cache validation") and a persistence flag file named .analytics_state to disguise the dropper as telemetry. A secondary loader with identical fetch/decode/chmod/spawn primitives (81 KB) is present in lib/telemetry.js, framed as an Analytics SDK but not referenced in the current version. The package is advertised as visual UI components, which has no legitimate reason to fetch or execute native binaries.
Indicators of compromise
- Packages
- platform-ui-island
- Domains
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf103-070.workers.dev
- oob-worker.cf99-9b3.workers.dev
- tin.dl.well1.site
- tina.dl.well1.site
- ldr.dl.well1.site
- win.dl.well1.site
Remediation
- Immediately remove platform-ui-island from all dependencies and lock files
- Audit all systems that installed or required platform-ui-island for signs of native binary execution or persistence mechanisms
- Block outbound connections to oob-worker.cf*.workers.dev and *.dl.well1.site domains
- Review process execution logs for spawned binaries from /var/tmp/.cache_ or dotnet_diag_.exe
- Regenerate credentials and secrets on any system that may have executed the payload
- Monitor for DNS TXT queries to *.dl.well1.site subdomains as an indicator of infection
Sources
- GitHub Advisory GHSA-3q7q-cmmw-mmr4 · GitHub Advisory Database
Cite this entry
"Malicious code in platform-ui-island (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-platform-ui-island-npm-7xb71p
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malware in sugarball-cli
Malware was distributed via the sugarball-cli npm package, resulting in full system compromise of affected machines. The advisory recommends treating any system with this package as fully compromised and rotating all secrets and keys from a different computer.
npmCompromised package - resolvedcritical
Malware in @zynkit/jwtbytes
Malware was discovered in the npm package @zynkit/jwtbytes, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malware in agent-bot-api
Malware was discovered in the npm package agent-bot-api. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malware in userbotjs
The npm package userbotjs contained malware that could fully compromise any system on which it was installed. The advisory recommends treating affected systems as fully compromised and rotating all secrets and keys from a different computer.
npmCompromised package