Malicious code in accounts-ddos-shield (npm)

Source: amazon-inspector 343cd6e6bdb885bf8fe4d59b376a32c5ab57f309707c4253b2bf7307d631be79 On require of the package, helpers.js selects a platform-specific payload path and downloads an opaque binary from one of several Cloudflare Workers hosts whose names are assembled from split string fragment...

Malicious code in platform-ui-colors (npm)

Source: amazon-inspector 118252cd198a6c0e985917992969dbbaf8e9792ccbc27fab0ebbab191a1e6023 On require of platform-ui-colors, both the declared main lib/telemetry.js and helpers.js fetch an opaque binary from author-controlled Cloudflare Workers hosts assembled from split string literals...

Malicious code in dolyame-ui-checkablegroup (npm)

Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js assemble destination hostnames at runtime from split-string...

Malicious code in dolyame-boxy-atom-bnpl-badge (npm)

Source: amazon-inspector 31ecc1e21adbb7890afdc37d9e00e09d56b9b66fc9793603884569d8beed29d7 On require of dolyame-boxy-atom-bnpl-badge, helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors oob-worker.cf100-.workers.dev, oob-worker.cf102-.workers.dev,...