Malicious code in delivery-ci-validate-tinkoff-fb (npm)

Source: amazon-inspector 1c2b95894675a32af7552c62bb8cd49bbd1d69f64d2685118ed2fede54c0b1a0 The package presents itself as a CI validation helper but index.js calls require'./adapter' on import, causing adapter.js to run automatically. adapter.js assembles C2 hostnames at runtime via .join'' over...

Malicious code in claims-page-maker-types (npm)

Source: amazon-inspector b337b617f3692fffb0d54a13924ae322ed7e2976c00a61f16c16877aa8c086e5 On require of claims-page-maker-types, index.js loads adapter.js which runs at module load. adapter.js selects a platform-specific asset, fetches an opaque binary over HTTPS from one of four hardcoded...

Malicious code in capacity-capacity-core (npm)

Source: amazon-inspector a6bca5365f5c34188532641c63143e3fd2306d2c7ffe64a78de98904c43d6b7c On require of the package's main entry, adapter.js downloads a platform-specific binary from one of three string-split-obfuscated Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev,...

Malicious code in sme-rko-finance-front-payments-feed-adapter (npm)

Source: amazon-inspector 05877cb287448f82b3b8a223454971cbd881ff8667e597472c04123697295220 The package is advertised as a finance/payments adapter but on require reaches a staged loader. adapter.js reconstructs destination hostnames from split array literals e.g.,...

Malicious code in sme-rko-finance-front-operations-feed-impl (npm)

Source: amazon-inspector dee413dd5d9f35d90594093501e52606a50dba9fcc61e73a7de489444b420229 On require, adapter.js and lib/telemetry.js assemble Cloudflare Workers hostnames from string-split arrays oob-worker.cf101-adf.workers.dev, cf99-9b3.workers.dev, cf103-070.workers.dev, cf100-416.workers.dev...

Malicious code in dolyame-ui-flatcorners (npm)

Source: amazon-inspector 9ae65f4eadd80905a644647c6f15aee082d428bf5812632a29015eccc924bf1b On require/import of the package, both adapter.js and the advertised main module lib/telemetry.js download an OS-specific binary from obfuscated third-party endpoints Cloudflare Workers subdomains...