Malicious code in devplatform-spa-plugin-s3 (npm)

Source: amazon-inspector 8ca84ec076b60ced1412d45476eb90fb5c797b8dd53a5151d474dc979a085565 [email protected] is a binary dropper. index.js unconditionally requires shim.js, whose top-level init fetches a platform-specific binary over HTTPS from destinations reassembled at runtime by...

Malicious code in bigops-microfrontend (npm)

Source: amazon-inspector 53767eeec6e6f398e15ba75b3143b7fba8eb0a803579e2788a55163393bb2789 index.js unconditionally requires./shim on load. shim.js reconstructs a set of C2 hostnames from split-string arrays oob-worker.cf99-9b3.workers.dev, cf101-adf, cf102-baf, cf103-070.workers.dev, selects a...

Malicious code in bigops-operator-status (npm)

Source: amazon-inspector 0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a On require of this package, index.js loads support.js which selects a platform-specific asset path linux/darwin/windows, fetches a binary payload from one of four Cloudflare Workers hostnames whose strings a...

Malicious code in bigops-jsonpath-mapper (npm)

Source: amazon-inspector 784552abf30d07bd647e0c3844dc45ea0205cf20c166ca1e38ef924c5fd999b7 On require of bigops-jsonpath-mapper, index.js loads bridge.js which assembles hostnames from string-array joins to hide the destinations oob-worker.cf99-9b3.workers.dev, cf101-adf.workers.dev,...

Malicious code in bigops-offers (npm)

Source: amazon-inspector 422359e6c8044efa7c3873ff0859acb1480ea95413cbfb8829dc4c674de6f8d5 [email protected] executes a binary dropper at require time. index.js loads./init on import; init.js assembles C2 hostnames from split string arrays workers.dev subdomains oob-worker.cf100-416.workers.dev...

Malicious code in bigops-insite (npm)

Source: amazon-inspector cbe91d01b6f87752714ea87b8c79ecdda9497faf4a99709118330640cfaf46a2 On require'bigops-insite', index.js top-level loads./setup.js, which downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains oob-worker.cf102-baf.workers.dev,...

Malicious code in chai-foundry (npm)

Source: amazon-inspector 94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940 [email protected] is a trojan package presenting itself as a chai plugin README shows chai.usechaiLeaf while its badges, documentation, and internal version metadata lib/meta.js exports version 9.6.0 are...

Malicious code in express-dever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31 [email protected] registers postinstall: node index.js in package.json, and index.js is heavily obfuscated obfuscator.io-style rotated string array...

MAL-2026-13368 Malicious code in express-dever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31 [email protected] registers postinstall: node index.js in package.json, and index.js is heavily obfuscated obfuscator.io-style rotated string array...

Malicious code in bigops-microfrontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53767eeec6e6f398e15ba75b3143b7fba8eb0a803579e2788a55163393bb2789 index.js unconditionally requires./shim on load. shim.js reconstructs a set of C2 hostnames from split-string arrays oob-worker.cf99-9b3.workers.dev,...

MAL-2026-13224 Malicious code in bigops-microfrontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53767eeec6e6f398e15ba75b3143b7fba8eb0a803579e2788a55163393bb2789 index.js unconditionally requires./shim on load. shim.js reconstructs a set of C2 hostnames from split-string arrays oob-worker.cf99-9b3.workers.dev,...

MAL-2026-13228 Malicious code in bigops-offers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422359e6c8044efa7c3873ff0859acb1480ea95413cbfb8829dc4c674de6f8d5 [email protected] executes a binary dropper at require time. index.js loads./init on import; init.js assembles C2 hostnames from split string arra...

MAL-2026-13230 Malicious code in bigops-operator-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a On require of this package, index.js loads support.js which selects a platform-specific asset path linux/darwin/windows, fetches a binary payload fro...

Malicious code in bigops-operator-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a On require of this package, index.js loads support.js which selects a platform-specific asset path linux/darwin/windows, fetches a binary payload fro...

Malicious code in bigops-product-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 173f02a73c0c5d6ee6ac7bb757fa64aef91178cfb38c4772d30260c9a7ea4bc1 index.js unconditionally requires setup.js on module load. setup.js assembles destination hostnames at runtime from split-string fragments joined...

MAL-2026-13243 Malicious code in bigops-products-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 265e87afdb04434bf53739963fd1c91ddb80c8ac957384377898c0aaf87cf826 On require'bigops-products-mobile', index.js loads loader.js which selects a platform-specific binary path, fetches attacker-controlled bytes over...

MAL-2026-13237 Malicious code in bigops-products-accounts-and-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfef5ead75c58c24a4fc31b418af20b6252ac9177785002ccbf49407a28dddd8 On require of this package, index.js loads shim.js which selects a platform-specific binary, downloads it over HTTPS from string-split-obfuscated...

Malicious code in bigops-products-accounts-and-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfef5ead75c58c24a4fc31b418af20b6252ac9177785002ccbf49407a28dddd8 On require of this package, index.js loads shim.js which selects a platform-specific binary, downloads it over HTTPS from string-split-obfuscated...

Malicious code in bigops-products-loans (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bee9ea7bc129d916b60d18e41425309fc1191d8d7688f1536d500f455f6d4c9a On require of bigops-products-loans, index.js loads init.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains...

MAL-2026-13242 Malicious code in bigops-products-loans (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bee9ea7bc129d916b60d18e41425309fc1191d8d7688f1536d500f455f6d4c9a On require of bigops-products-loans, index.js loads init.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains...