Malicious code in claims-to-iso-string-with-timezone (npm)

Source: amazon-inspector c313bb681d365fedf6993c01c72c1e6e703b2b5124c8c35c19a730d5b2d4f7aa On require of claims-to-iso-string-with-timezone, index.js loads./init.js which downloads a platform-specific binary from obfuscated author-controlled endpoints Cloudflare Workers hostnames...

Malicious code in sme-rko-finance-front-operations-other (npm)

Source: amazon-inspector c11dc6f375e9ceaee8f1b8e40db07f49c88e7bc47715759b101d3513399047be On require/import, init.js selects an OS/arch-specific binary and downloads it from a rotating set of Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-inputrange (npm)

Source: amazon-inspector aae096235cf72db7f2e9908e53fa5a6e7c87718539a9e3452e0e34f7345ca80f On require of dolyame-ui-inputrange, init.js reconstructs a rotating list of Cloudflare Workers hostnames via split-string joins e.g. "oob-worke","r.cf101-adf.workers.de","v".join"" plus a DNS-TXT fallback...

Malicious code in eacq-cdk (npm)

Source: amazon-inspector 0fdb6bb562df94959130d84e06dc14aa40e9347c60da24dd32ce672024c2e0aa Requiring the package executes init.js, which selects a platform-specific payload path and fetches an executable over HTTPS from Cloudflare Workers hosts whose names are assembled via.join'' from...

Malicious code in bigops-legacy-telephony-panel (npm)

Source: amazon-inspector 610b2084c8573d9a89262f1a4dcd8ff26acdcc0568f7fa29ac5a921a292e390a On require of this package, index.js loads init.js which at module load fetches a platform-specific binary from hostnames reassembled at runtime from split string arrays oob-worker.cf10-1-adf.workers.dev,...