{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "_helpers.js",
              "sha256": "0121e830aa822c7257e9dafb2d116d8f05d5e948bc7e7b2750564be7736c0f0e",
              "tlsh": "6fa1b65a26fa30180792e5d8891f5816719afa533385d8c4ff0c66945fd727883b29ec"
            },
            {
              "path": "lib/telemetry.js",
              "sha256": "fa261ee795326f5f8b726c79857f05a97a4a54b854841eee0026ef1803e77ede",
              "tlsh": "c2733f4966fb10214263b0685ebb40437635c4072a4eed5dba9c43ec9f8db3896f1fb9"
            }
          ],
          "package_integrity": [
            {
              "filename": "platform-ui-colors-35.8.1.tgz",
              "hashes": {
                "sha1": "18dfb240a26fb985a797684c4383df28b8492356",
                "sha512_sri": "sha512-ED39KI3b3yjqNemzyWtqigKsvSaxblWViX0sCKzNrU/E0qulm3U7q4jNfyKley4ugYvPX2BRg31BOifVCncvcQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "platform-ui-colors"
      },
      "versions": [
        "35.8.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017012",
        "import_time": "2026-08-07T12:51:22.128613507Z",
        "modified_time": "2026-08-07T12:31:00Z",
        "sha256": "118252cd198a6c0e985917992969dbbaf8e9792ccbc27fab0ebbab191a1e6023",
        "source": "amazon-inspector",
        "versions": [
          "35.8.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (118252cd198a6c0e985917992969dbbaf8e9792ccbc27fab0ebbab191a1e6023)\nOn require of platform-ui-colors, both the declared main lib/telemetry.js and _helpers.js fetch an opaque binary from author-controlled Cloudflare Workers hosts assembled from split string literals (oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev) with a DNS-TXT fallback to *.dl.wel1.ru, write it to /tmp/.cache_\u003cuid\u003e or %TEMP%\\dotnet_diag_\u003cuid\u003e.exe, chmod 755 the file, and detached-spawn it via cp.spawn(\u0027/bin/sh\u0027, [\u0027-c\u0027, filePath+\u0027 \u0026\u0027], {detached:true}). Sensitive API names (\u0027child_\u0027+\u0027process\u0027, \u0027chmod\u0027+\u0027Sync\u0027) and destination hosts are reconstructed from split literals to evade static analysis, and no hash or signature verifies the fetched bytes. Requiring the package yields arbitrary code execution on the installer\u0027s host under the installer\u0027s user, with a persistent staged binary on disk.\n",
  "id": "MAL-2026-13603",
  "modified": "2026-08-07T12:31:00Z",
  "published": "2026-08-07T12:31:00Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/platform-ui-colors/v/35.8.1"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in platform-ui-colors (npm)"
}