Malicious code in claims-auth-domain (npm)

Source: amazon-inspector 689620689df62b0e31d3caeb29327b88da40bae2bb66da3075dde6ee311ea6c3 On require'claims-auth-domain', index.js loads vendor.js which selects a platform-specific endpoint, downloads a binary from hardcoded attacker infrastructure, stages it under /tmp or %TEMP% with a disguised...

Malicious code in checkout-types (npm)

Source: amazon-inspector 5d17ce247f3e7fa94b43e93af7597a9ae8a2a4008048a1ae8deb9352f45fc731 On require of checkout-types, index.js loads vendor.js which runs setup at top level. The code reconstructs C2 hostnames from split string arrays oob-worker.cf103-070.workers.dev,...

Malicious code in certificates-revocation-utils (npm)

Source: amazon-inspector 4f10384b425fd13237d69f5a9d71f6c893bd9063b32be2665f8a30f95ddda837 On module load, index.js requires vendor.js which fetches a platform-specific binary from runtime-reconstructed Cloudflare Workers hostnames assembled via split-string concatenation such as...

Malicious code in sme-rko-finance-front-operations-fee (npm)

Source: amazon-inspector 6a2ef64871ebe6bf7dd675b3e686beec5a90dbaec72760b647e3c876674df9c5 The package's main entry ./lib/telemetry and its vendor.js module execute a binary dropper at require/import time. Hostnames and API identifiers are reconstructed from split-string arrays to evade static...

Malicious code in delivery-ci-jira (npm)

Source: amazon-inspector dd9d9e3f0c2ec7d61ce6eee1e05cc93fe5807853e436fcf5aa751bc30f84e36d On require of delivery-ci-jira, vendor.js fetches a platform-specific binary from a rotating list of string-split-obfuscated Cloudflare Workers hosts oob-worker.cf102-baf.workers.dev,...

Malicious code in devplatform-spa-ui (npm)

Source: amazon-inspector fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428 On require, vendor.js selects a per-OS payload URL, fetches a binary from rotating .workers.dev hosts with a DNS-TXT base64 fallback via .dl.wel1.ru, writes it to a hidden temp path .cache on Unix,...