The platform-ui-island npm package version 20.5.9 includes an index.js that loads _bridge.js, which downloads a native binary payload from obfuscated Cloudflare Workers domains assembled at runtime to evade detection. The payload is saved to misleading file paths (dotnet_diag_<hex>.exe on Windows, /var/tmp/.cache_<hex> on Unix), given executable permissions, and spawned detached via system shells. If HTTPS download fails, the payload is reconstructed from base64-encoded chunks retrieved through DNS TXT queries to *.dl.well1.site subdomains, a covert channel designed to bypass HTTPS egress filtering. The package also contains a dormant secondary loader framed as an Analytics SDK. The package's behavior is inconsistent with its advertised purpose as a UI component library, indicating malicious intent. Systems with this package installed should be considered fully compromised.

Any system with platform-ui-island version 20.5.9 installed is fully compromised, as the package downloads and executes arbitrary native code with elevated privileges. This can lead to complete system takeover, unauthorized access to secrets and keys, and persistent malicious presence. Immediate secret/key rotation is necessary as attackers may have exfiltrated sensitive information. Removal of the package alone may not eliminate all malicious components due to potential persistence mechanisms.

No official patch or remediation is currently documented. The package should be immediately removed from all affected systems. All secrets and keys stored on compromised systems must be rotated from a secure, unaffected environment. Due to the high likelihood of full system compromise, consider rebuilding affected systems from known good backups or reinstalling the operating system. Monitor for any suspicious activity related to this package and block network access to the identified malicious domains if possible. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.