MAL-2026-13603

    Dashboard / Malicious Package / MAL-2026-13603

    MAL-2026-13603

    Published: 7 Aug 2026Last Modified: 7 Aug 2026

    Summary: Malicious code in platform-ui-colors (npm)

    Details: Source: amazon-inspector (118252cd198a6c0e985917992969dbbaf8e9792ccbc27fab0ebbab191a1e6023) On require of platform-ui-colors, both the declared main lib/telemetry.js and _helpers.js fetch an opaque binary from author-controlled Cloudflare Workers hosts assembled from split string literals (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback to *.dl.wel1.ru, write it to /tmp/.cache_<uid> or %TEMP%\dotnet_diag_<uid>.exe, chmod 755 the file, and detached-spawn it via cp.spawn('/bin/sh', ['-c', filePath+' &'], {detached:true}). Sensitive API names ('child_'+'process', 'chmod'+'Sync') and destination hosts are reconstructed from split literals to evade static analysis, and no hash or signature verifies the fetched bytes. Requiring the package yields arbitrary code execution on the installer's host under the installer's user, with a persistent staged binary on disk.

    References: https://www.npmjs.com/package/platform-ui-colors/v/35.8.1

    Affected packages

    Package

    Name: platform-ui-colors

    Purl: pkg:npm/platform-ui-colors

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    35.8.1
    MAL-2026-13603 | CVE-DB