Malicious code in tui-react-mobile-styles (npm)
The npm package tui-react-mobile-styles contains malicious code that performs a full binary dropper chain at module load time, downloading and executing platform-specific payloads to grant full host code execution. The package masquerades as a React Native UI styles library but executes arbitrary code via obfuscated child_process and fs calls.
- Disclosed
- Last updated
- Blast radius
- Any system that installs or requires tui-react-mobile-styles; full host code execution possible.
- Ecosystems
- Attack vectors
- Affected entities
- tui-react-mobile-stylesnpm package presenting as React Native/mobile UI styles library but containing malicious binary dropper chain
The npm package tui-react-mobile-styles was identified as containing malicious code that executes at module load time. The package presents itself as a React Native/mobile UI styles library but performs a full binary dropper chain upon installation or require.
At module load, index.js requires ./_shim, which reconstructs destination hostnames from split string fragments to yield three Cloudflare Workers endpoints (oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev), plus a DNS-TXT chunked-base64 fallback path over *.dl.well1.site for HTTPS-blocked environments.
The shim.js module downloads a platform-specific payload, writes it to /var/tmp (Unix) or %TEMP% (Windows) under cover-story filenames (.cache on Unix, dotnet_diag_.exe on Windows), sets executable permissions (chmod 0755), and spawns it detached via /bin/sh -c or cmd /c start /b. The lib/telemetry.js file contains identical drop-and-exec primitives with obfuscated API names (require("child_" + "process"), fs["chmod" + "Sync"]) to defeat static analysis.
The malicious behavior has no relation to the package's stated UI-styles purpose and grants full-host code execution to whoever controls the Workers endpoints on any machine that installs or requires this package. The incident was identified by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- tui-react-mobile-styles
- Domains
- oob-worker.cf99-9b3.workers.dev
- oob-worker.cf101-adf.workers.dev
- oob-worker.cf100-416.workers.dev
- dl.well1.site
Remediation
- Immediately uninstall tui-react-mobile-styles from all systems and projects
- Audit package.json and lock files (package-lock.json, yarn.lock) for any presence of tui-react-mobile-styles
- Review npm audit logs and dependency trees to identify all affected installations
- Assume full host compromise on any system that installed or required this package; perform forensic analysis and consider system rebuild
- Monitor outbound connections to oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev, and *.dl.well1.site for evidence of payload delivery
- Use npm to report and block this package from your organization's registry or proxy
- Review and update npm security policies to detect and prevent installation of packages with suspicious obfuscated code patterns
Sources
- GitHub Advisory GHSA-c8m3-2v45-wg8x · GitHub Advisory Database
Cite this entry
"Malicious code in tui-react-mobile-styles (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-tui-react-mobile-styles-npm-1x39j7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - containedcritical
Malicious code in epic-common (npm)
The npm package epic-common was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package - resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package