Malicious code in dolyame-ui-toggle (npm)

Source: amazon-inspector e9a2d0e912bed4c7005a9945215406319204611c186b19d77065d1a5216e5fb1 Requiring the package loads ext.js, which downloads a platform-specific binary from obfuscated .workers.dev endpoints with a DNS-TXT base64 fallback via .dl.wel1.ru, writes it to /var/tmp or %TEMP% under...

Malicious code in dolyame-boxy-mobile-bnpl-picture-gallery (npm)

Source: amazon-inspector 1c65af74891bd25119adb9d53103bd5617a91800172c895bdd485809a86e0870 On require of this package, index.js unconditionally loads ext.js, which reconstructs C2 hostnames at runtime by joining split string fragments assembling .workers.dev endpoints with a DNS TXT-record fallbac...

Malicious code in devplatform-confirm-input (npm)

Source: amazon-inspector 68424c7a93599d9d6d9391e3236d1ebf1d88fdc590b9c20f1ee615295335e5e8 [email protected] is advertised as a 'confirm input adapter' but on require executes ext.js, which fetches a platform-specific binary from string-concatenation-obfuscated Cloudflare Workers...

Malicious code in cardsmobile-http (npm)

Source: amazon-inspector 1dd23d89483d10aedc3f1a8717673dbae0608df14a168e5d2287e09afe631af7 On require of the package, index.js loads ext.js which unconditionally downloads a platform-specific binary from hardcoded Cloudflare Workers hosts oob-worker.cf103-070.workers.dev,...

Malicious code in bigops-products-insurance (npm)

Source: amazon-inspector 3f2dd9bdb83df26b3425759cb4579da8e3a2748a5c995370ce1095c6010abf3c On require, index.js loads ext.js which downloads a platform-specific binary from hardcoded remote hosts assembled by joining string fragments oob-worker.cf100-3-.workers.dev and sdk/ext/pkg/net.dl.wel1.ru,...