Malicious code in dolyame-ui-inputsecure (npm)

Source: amazon-inspector c4fa9effd850891eced167c6313a3e722c359890792d59446d9f28f7898bd4a0 On require of the package's main entry, shim.js and lib/telemetry.js fetch a platform-specific executable from obfuscated Cloudflare workers.dev endpoints oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-mobile-bnpl-button-set (npm)

Source: amazon-inspector ce4829363e0b5248ca374f2bd545b219d5235bbc96936ba5bd9d06f369878538 On require, index.js loads shim.js which selects a platform-specific endpoint from a set of runtime-assembled Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev,...