MAL-2026-12053 Malicious code in tui-react-mobile-styles (npm)

The package presents itself as a React Native/mobile UI styles library but at module load time performs a full binary dropper chain. index.js require()s./shim, which runs an init() at module load that reconstructs destination hostnames from split string fragments to yield oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev, and oob-worker.cf100-416.workers.dev, plus a DNS-TXT chunked-base64 fallback path over *.dl.well1.site for environments blocking HTTPS. shim.js downloads a platform-specific payload, writes it to /var/tmp (or %TEMP%) under cover-story filenames (.cache<hex> on Unix, dotnet_diag<hex>.exe on Windows), chmods it 0755, and spawns it detached via /bin/sh -c "<path> &" or cmd /c start /b. lib/telemetry.js contains the same drop-and-exec primitives (base64 chunk assembly, chmod 0755, detached /bin/sh spawn), with API names split (require("child_" + "process"), fs["chmod" + "Sync"]) to defeat static analysis. The behavior has no relation to the package's stated UI-styles purpose and grants full-host code execution to whoever controls the Workers endpoints on any machine that installs or requires this package.