platform-ui-colors

{"modified":"2026-08-07T12:31:00Z","published":"2026-08-07T12:31:00Z","schema_version":"1.7.4","id":"MAL-2026-13603","summary":"Malicious code in platform-ui-colors (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (118252cd198a6c0e985917992969dbbaf8e9792ccbc27fab0ebbab191a1e6023)\nOn require of platform-ui-colors, both the declared main lib/telemetry.js and _helpers.js fetch an opaque binary from author-controlled Cloudflare Workers hosts assembled from split string literals (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback to *.dl.wel1.ru, write it to /tmp/.cache_<uid> or %TEMP%\\dotnet_diag_<uid>.exe, chmod 755 the file, and detached-spawn it via cp.spawn('/bin/sh', ['-c', filePath+' &'], {detached:true}). Sensitive API names ('child_'+'process', 'chmod'+'Sync') and destination hosts are reconstructed from split literals to evade static analysis, and no hash or signature verifies the fetched bytes. Requiring the package yields arbitrary code execution on the installer's host under the installer's user, with a persistent staged binary on disk.\n","affected":[{"package":{"ecosystem":"npm","name":"platform-ui-colors"},"versions":["35.8.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"_helpers.js","sha256":"0121e830aa822c7257e9dafb2d116d8f05d5e948bc7e7b2750564be7736c0f0e","tlsh":"6fa1b65a26fa30180792e5d8891f5816719afa533385d8c4ff0c66945fd727883b29ec"},{"path":"lib/telemetry.js","sha256":"fa261ee795326f5f8b726c79857f05a97a4a54b854841eee0026ef1803e77ede","tlsh":"c2733f4966fb10214263b0685ebb40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"}],"package_integrity":[{"filename":"platform-ui-colors-35.8.1.tgz","hashes":{"sha1":"18dfb240a26fb985a797684c4383df28b8492356","sha512_sri":"sha512-ED39KI3b3yjqNemzyWtqigKsvSaxblWViX0sCKzNrU/E0qulm3U7q4jNfyKley4ugYvPX2BRg31BOifVCncvcQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/platform-ui-colors/v/35.8.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017012","import_time":"2026-08-07T12:51:22.128613507Z","modified_time":"2026-08-07T12:31:00Z","sha256":"118252cd198a6c0e985917992969dbbaf8e9792ccbc27fab0ebbab191a1e6023","source":"amazon-inspector","versions":["35.8.1"]}]}}