MalwarePublished 5 Aug 2026

platform-ui-island (npm) · Malicious Code

Affects platform-ui-islandSource GCVE Database

Malicious package : remove platform-ui-island and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 19:27 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12042

What to do

Remove platform-ui-island from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmplatform-ui-island	Affected =20.5.9	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package platform-ui-island version 20.5.9 contains malicious code that downloads and executes platform-specific native binaries from obfuscated Cloudflare Workers hosts. The payload is saved to deceptive file paths and executed with elevated permissions. If HTTPS retrieval fails, the payload is reconstructed via DNS TXT queries to bypass egress filtering. The package masquerades as a UI component library but performs unauthorized code execution, effectively compromising any system on which it is installed. Removal of the package does not guarantee full remediation due to potential persistent malicious activity.

Impact

Any system with platform-ui-island version 20.5.9 installed is fully compromised, as the package downloads and executes arbitrary native code with elevated privileges. This can lead to complete system takeover, unauthorized access to secrets and keys, and persistent malicious presence. Immediate secret/key rotation is necessary as attackers may have exfiltrated sensitive information. Removal of the package alone may not eliminate all malicious components due to potential persistence mechanisms.

Defensive guidance

The package should be immediately removed from all affected systems. All secrets and keys stored on compromised systems must be rotated from a secure, unaffected environment. Due to the high likelihood of full system compromise, consider rebuilding affected systems from known good backups or reinstalling the operating system. Monitor for any suspicious activity related to this package and block network access to the identified malicious domains if possible.

Summary

The platform-ui-island npm package version 20.5.9 includes an index.js that loads _bridge.js, which downloads a native binary payload from obfuscated Cloudflare Workers domains assembled at runtime to evade detection. The payload is saved to misleading file paths (dotnet_diag_<hex>.exe on Windows, /var/tmp/.cache_<hex> on Unix), given executable permissions, and spawned detached via system shells. If HTTPS download fails, the payload is reconstructed from base64-encoded chunks retrieved through DNS TXT queries to *.dl.well1.site subdomains, a covert channel designed to bypass HTTPS egress filtering. The package also contains a dormant secondary loader framed as an Analytics SDK. The package's behavior is inconsistent with its advertised purpose as a UI component library, indicating malicious intent. Systems with this package installed should be considered fully compromised.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 19:27 UTC

Technical details

References

Community reviews