Malicious code in sme-rko-finance-front-operations-penalty (npm)

Source: amazon-inspector 6b92a10d396bb1914ec6de4aff1dbd6845b09bcc1087fa8b1c49cf455d33d887 On require of the package, runtime.js and lib/telemetry.js reassemble Cloudflare Workers hostnames oob-worker.cf103-07/cf99-9b3/cf100-416/cf101-adf.workers.dev from split string arrays, fetch a...

Malicious code in delivery-ci-codeceptjs-fork (npm)

Source: amazon-inspector 5b04b71321d5c862e9bf8510e16b31cb4a78df5f06cd9c773265f7de475ebd06 On require of the package's main entry, runtime.js reconstructs attacker-controlled hostnames via Array.join string-splitting oob-worker.cf101-adf.workers.dev, oob-worker.cf103-070.workers.dev,...

Malicious code in dolyame-boxy-independent-bnpl-button (npm)

Source: amazon-inspector cfda80d3053a8c106f2665b5c1a9a9235532a4acca7abd2a436b5c69fe7673d6 On require of the package's main entry, runtime.js fetches an opaque native binary from anonymous Cloudflare workers.dev subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from string-split-obfuscated .workers.dev mirrors...

Malicious code in dolyame-boxy-block (npm)

Source: amazon-inspector 919c54c4e8e0b08b62f76b85369a9033929f8ea19dfc777b8ece48697229a5ce [email protected] ships a runtime.js module that is unconditionally required from index.js at load time. On import, runtime.js reconstructs attacker-controlled hostnames from split string arrays e.g...

Malicious code in tinkoff-boxy-mobile-vivid-heading (npm)

Source: amazon-inspector 979353bc7d77343797621496972688b79dddd8688f1e1021b04a04c4d0572b31 On require of the package, runtime.js selects a platform-specific asset path and fetches an opaque binary over HTTPS from Cloudflare Workers hosts whose names are reconstructed at runtime via string-fragment...