Malicious code in devplatform-api-v2-resources-metadata (npm)

Source: amazon-inspector 8cae6c0242748cb5392c3d1036f34fcb2e8dd6743abb4e94100665f1ce5b8dab Package presents itself as a REST API client wrapper, but requiring it loads platform.js which detects the host OS/architecture, fetches a platform-matched native binary from three...

Malicious code in checkout-total-logic (npm)

Source: amazon-inspector 297980540b58c9daf802d92602f2a809348bd6ac1492537d6e291f704702dc0a On require of the package, index.js loads platform.js, which reconstructs endpoint hostnames from split string fragments resolving to oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, and...

Malicious code in dolyame-ui-mediainfohoc (npm)

Source: amazon-inspector e5c5b48487d5c9507487229c44557753bf7a95300242096be119eba5df451adf On require of the package, platform.js selects a platform-specific asset, downloads an opaque binary from one of three hardcoded Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev, cf101-adf, cf103-070...

Malicious code in dolyame-ui-datatable (npm)

Source: amazon-inspector 730797abef8484a4993cfa7241f5b4ac3c407e837b182e3d117448941b7eaf33 The package's main entry requires platform.js, which on load downloads a platform-specific binary from anonymous Cloudflare Workers subdomains oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.de...

Malicious code in docflow-cryptopro (npm)

Source: amazon-inspector b838ab488feb43fe2b50d6cd00579d3c1528877ea84d935ca89d8d863528bd25 On require of the package's main, platform.js downloads an opaque platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames assembled from split string fragments such as...

Malicious code in tinkoff-component-infopanel (npm)

Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev,...