Malicious code in devplatform-integrations-tests-lib (npm)

Source: amazon-inspector 5a69dc1ca445f24f40d0b4b24dc010a7d85c8994c65d215f2c6e5efe5dfac28f On require, bootstrap.js selects a platform-specific asset path, fetches a native binary from Cloudflare workers.dev hosts e.g. oob-worker.cf101-adf.workers.dev with a DNS-TXT fallback to .dl.wel1.ru, writes...

Malicious code in checkout-subscription-holder (npm)

Source: amazon-inspector e7a62aaa04f6806d8ad86f8c9baaaddde733815a4d2f51bc3db803bf30998f4c On require of the package, index.js loads bootstrap.js inside a try/catch. bootstrap.js reconstructs its download hosts via array.join"" string-splitting assembling...

Malicious code in certificates-revocation-sw (npm)

Source: amazon-inspector 3037d3d739bf6d25fbb06a613915278de458d3b90547bdbf11b2710b7d88d82a The package's index.js unconditionally loads bootstrap.js, which on require fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf103-070.workers.dev and similar, assembled...

Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)

Source: amazon-inspector 6d957fec8c08e1dcadbcd6e4b6933a1c1482356e79adbfe1f6ceb6d64a68855f On require of the package, bootstrap.js selects a platform-specific path from a hardcoded map, downloads an opaque binary from one of three Cloudflare Workers hosts whose names are reassembled at runtime fro...

Malicious code in delivery-ci-cli (npm)

Source: amazon-inspector 25daa792f30733f69d4530266b44c1b6ba9a5f4d11f47cce95b714792a39ca89 On require of delivery-ci-cli, index.js loads bootstrap.js which downloads a platform-specific native binary from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-inputpassword (npm)

Source: amazon-inspector fbe3efece732cd0eab0df9c3fa387540804b7a1f7a911a340c3852e7f2c54674 On require of the package, index.js loads lib/telemetry.js which, together with bootstrap.js, fetches a platform-specific binary from a rotating list of anonymous Cloudflare Workers hosts...

Malicious code in dolyame-boxy-mobile-bnpl-card-gallery (npm)

Source: amazon-inspector d25f027b45e1dd0483fdacb92c8af5b25302f2785de7a7a5c259b8d535597d80 On require of the package, bootstrap.js fetches an opaque binary over HTTPS from a rotating list of Cloudflare Workers subdomains with a DNS-TXT chunked-retrieval fallback to .wel1.ru, writes it to...