Malicious code in devplatform-nx-svelte (npm)

Source: amazon-inspector 19a9e164d3a912ce2cb11abb935eb46fdfa9bb7ef12acbe4a305867cb8942306 On require of the package, compat.js constructs C2 hostnames by joining split string fragments to evade static inspection, downloads a platform-specific executable from Cloudflare Workers subdomains...

Malicious code in claims-microgen-templates (npm)

Source: amazon-inspector 9d4eefb6f5d91cfe86acf925e0d84b5cb34336f98cf73586e01d17418d02454f On require of the package, index.js loads compat.js which fetches a platform-specific binary from string-concatenated Cloudflare Workers hosts oob-worker.cf1-01-adf.workers.dev,...

Malicious code in sme-rko-finance-front-payments-feed-display-list (npm)

Source: amazon-inspector eedf1850bd0f58b8adef8a6b6c3ac13adf7848819306e5a7b9518cbb174911a3 On require of the package's main module, compat.js unconditionally downloads a platform-specific executable and runs it. Destination hosts are assembled at runtime from split string arrays e.g...

Malicious code in dolyame-ui-overridestyles (npm)

Source: amazon-inspector 38d2bc1cbc6567633387613915ff6d5637770cfa636a8d0ec14c99ef91b73a72 On require of the package, compat.js invokes a setup routine that downloads a platform-specific binary from Cloudflare Workers hosts assembled by joining split string fragments oob-worker.cf99-9b3.workers.de...

Malicious code in dolyame-boxy-atom-bnpl-popup (npm)

Source: amazon-inspector 26bfa012ebc79b0bf89d9eff7b1b0279bba4df11c76f80f6e81171f67d0dd7e5 On require, compat.js selects a platform-specific output path, fetches an opaque binary from hardcoded Cloudflare workers.dev subdomains assembled at runtime from split string fragments such as...

Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)

Source: amazon-inspector 6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f On require of the package's main entry, compat.js runs as a side effect: it selects a per-platform payload, fetches a native binary over HTTPS from one of several Cloudflare Workers hosts whose names are...

Malicious code in platform-ui-codemods (npm)

Source: amazon-inspector 1c72999be0ce122b904fcb710f5438a0d1718a3d121dd1377123c5d710aa9e27 On require of the package, index.js loads./compat.js whose top-level init downloads a platform-specific binary from a set of Cloudflare Workers mirrors whose hostnames are assembled at runtime from...

Malicious code in tinkoff-ui-action (npm)

Source: amazon-inspector c00c178eed539f0535846617d7201e635f073f5f6477d7c9e2d1a6ce53f68d36 On require of the package's main entry, compat.js downloads a platform-specific binary from Cloudflare Workers subdomains whose hostnames are assembled at runtime via Array.join to evade static analysis e.g...