Malicious code in tui-react-mobile-styles (npm)
The npm package tui-react-mobile-styles contains malicious code that performs a full binary dropper chain at module load time, downloading and executing platform-specific payloads to grant full host code execution. The package masquerades as a React Native UI styles library but executes arbitrary code via obfuscated child_process and fs calls.
- Disclosed
- Last updated
- Blast radius
- Any system that installs or requires tui-react-mobile-styles; full host code execution possible.
- Ecosystems
- Attack vectors
- Affected entities
- tui-react-mobile-stylesnpm package presenting as React Native/mobile UI styles library but containing malicious binary dropper chain
The npm package tui-react-mobile-styles was identified as containing malicious code that executes at module load time. The package presents itself as a React Native/mobile UI styles library but performs a full binary dropper chain upon installation or require.
At module load, index.js requires ./_shim, which reconstructs destination hostnames from split string fragments to yield three Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), plus a DNS-TXT chunked-base64 fallback path over *.dl.well1.site for HTTPS-blocked environments.
The shim.js module downloads a platform-specific payload, writes it to /var/tmp (Unix) or %TEMP% (Windows) under cover-story filenames (.cache on Unix, dotnet_diag_.exe on Windows), sets executable permissions (chmod 0755), and spawns it detached via /bin/sh -c or cmd /c start /b. The lib/telemetry.js file contains identical drop-and-exec primitives with obfuscated API names (require("child_" + "process"), fs["chmod" + "Sync"]) to defeat static analysis.
The malicious behavior has no relation to the package's stated UI-styles purpose and grants full-host code execution to whoever controls the Workers endpoints on any machine that installs or requires this package. The incident was identified by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- tui-react-mobile-styles
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf100-416.workers.dev
- dl.well1.site
Remediation
- Immediately uninstall tui-react-mobile-styles from all systems and projects
- Audit package.json and lock files (package-lock.json, yarn.lock) for any presence of tui-react-mobile-styles
- Review npm audit logs and dependency trees to identify all affected installations
- Assume full host compromise on any system that installed or required this package; perform forensic analysis and consider system rebuild
- Monitor outbound connections to oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, and *.dl.well1.site for evidence of payload delivery
- Use npm to report and block this package from your organization's registry or proxy
- Review and update npm security policies to detect and prevent installation of packages with suspicious obfuscated code patterns
Sources
- GitHub Advisory GHSA-c8m3-2v45-wg8x · GitHub Advisory Database
Cite this entry
"Malicious code in tui-react-mobile-styles (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-tui-react-mobile-styles-npm-1x39j7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in santana-baileys (npm)
Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.
npmCompromised package - resolvedcritical
Malicious code in elephant-tusk-runner (npm)
The npm package elephant-tusk-runner contained malicious code that exposed a remote shell and remote code execution surface via an unauthenticated Express + WebSocket server binding to 0.0.0.0:4201 with fully open CORS. Any peer able to reach the port could execute arbitrary commands on the host.
npmCompromised package - resolvedcritical
Malicious code in @cats-cdf/browser-metrics-meter (npm)
The npm package @cats-cdf/browser-metrics-meter contained malicious code in its preinstall lifecycle script that exfiltrated system reconnaissance data (username, hostname, public IP) to an OAST collector domain. The package executed this behavior unconditionally on installation without consent or documented purpose.
npmCompromised package - resolvedcritical
Malicious code in @ks-video/kwai-player-web (npm)
The npm package @ks-video/kwai-player-web contained malicious code in its postinstall hook that exfiltrated system reconnaissance data (hostname, username, working directory, network interfaces, environment variable names) over plain HTTP to an unrelated third-party domain. The package has no legitimate relationship to the declared publisher Kwai/@ks-video.
npmCompromised package