Malicious code in eacq-acq-menu-core (npm)

Source: amazon-inspector daaba295870311c8170bc4ec82050e0f4ba2989be2b3e10de136647fc18ea6fc On require, index.js loads helpers.js which reconstructs C2 hostnames from split-string arrays e.g., 'oob-worker.cf.workers.dev' and 'sdk.dl.wel1.ru' and downloads a platform-specific binary via https.get. T...

Malicious code in eacq-acq-menu (npm)

Source: amazon-inspector ae7929c06f789a6fc910fd4ce4697fd5d32f06b55a0c9b5e406110f90676c239 On require of the package, index.js loads adapter.js which unconditionally executes a setup routine that fetches a platform-specific binary from runtime-reconstructed hosts Cloudflare workers.dev subdomains...

Malicious code in eacq-api (npm)

Source: amazon-inspector 1f72372a4c98fc1b4f187839fabe1a0bf8f7d98c8250c06baebf129920474332 On require of eacq-api, index.js loads compat.js which reconstructs C2 hostnames from string-split fragments oob-worker.cf100,1,2,3-.workers.dev and a DNS TXT chunked-base64 fallback channel over .dl.wel1.ru...

Malicious code in dwsai-dwsai-core (npm)

Source: amazon-inspector 4d9ec945df21e9ec2a52fc5dccf5b2d8f734c53aba8c9b6bd14f515c8e4a4fc8 On require'dwsai-dwsai-core', index.js loads adapter.js which downloads a platform-specific binary from author-controlled Cloudflare Workers mirrors and writes it to /tmp/.cache on Linux/macOS or...

Malicious code in dws-frontend-dws-frontend-core (npm)

Source: amazon-inspector 7fb73f65c18cf45f29f533ef6b9ab1278412909686c0750018f9d35170ed39f2 On require of this package, index.js loads support.js which downloads a platform-specific binary over HTTPS from author-controlled hosts under oob-worker.cf1.workers.dev with a DNS TXT-record base64 fallback...

Malicious code in dp-web-header (npm)

Source: amazon-inspector ec4c10894526621b93c3dba8f579e76be53db3989ab0ddb32c72bff180266786 The package advertises itself as a web header library but its index.js unconditionally requires ext.js on load. ext.js downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in dp-owners (npm)

Source: amazon-inspector 09f190519e55e1e9899983a76806e839baf855abf0a0120e83bcac5547405c09 On require of dp-owners, init.js selects a platform-specific path, downloads a binary from hardcoded Cloudflare Workers hosts assembled via string-split concatenation oob-worker.cf103-070.workers.dev,...

Malicious code in dolyame-ui-utils (npm)

Source: amazon-inspector 899f518db368635c0c794a8097fc0af3a2c85f61cdb4dcfbd81b0cf85629f199 On require of the package, polyfill.js selects a platform-keyed URL, fetches an opaque binary over HTTPS from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-ui-types (npm)

Source: amazon-inspector 237fff59f0e3f9c92ab2644c3ec861289c7132a613b7886e41820b2a04054d38 On require of the package, helpers.js downloads a platform-specific binary from hardcoded Cloudflare Workers mirrors oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-textarea (npm)

Source: amazon-inspector 24932ddb1e2cd6672b95aae062c330f9aec9d68ee293488d54d195fbbf0acc52 The package's main entry unconditionally requires./loader.js on load. loader.js assembles mirror hostnames from split string arrays to build a set of .workers.dev endpoints e.g. oob-worker.cf10x-.workers.dev...

Malicious code in dolyame-ui-toggle (npm)

Source: amazon-inspector e9a2d0e912bed4c7005a9945215406319204611c186b19d77065d1a5216e5fb1 Requiring the package loads ext.js, which downloads a platform-specific binary from obfuscated .workers.dev endpoints with a DNS-TXT base64 fallback via .dl.wel1.ru, writes it to /var/tmp or %TEMP% under...

Malicious code in dolyame-ui-tag (npm)

Source: amazon-inspector 62b169f56912efe4d5ade33f60cbc3f4b220ac0c447ff5821d8cd96635a1a67c On require of the package, index.js loads./ext, which downloads a platform-specific binary from Cloudflare Workers hosts assembled at runtime from split string fragments oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-ui-test (npm)

Source: amazon-inspector 8abf19141792782fd8e8520fc11368eabbc6114f8dd8c025136dd460ca3c3d1d index.js unconditionally requires./platform on module load. platform.js reconstructs attacker-controlled hostnames via string-splitting Array.join to fetch a platform-specific native binary from one of four...

Malicious code in dolyame-ui-tabs (npm)

Source: amazon-inspector 4beccb0ba046e54873e7d6af1d2023eb5f01a0eab4ed5abe336de2e3e3a74993 index.js requires./support, whose top-level run fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains reconstructed via array.join such as 'oob-worker.cf102-baf.','worker','s.','de...

Malicious code in dolyame-ui-tooltip (npm)

Source: amazon-inspector 0fa2102880c7088cf1644fc7731a7fc59b6406477c1939e2dbc0382e8724ad20 The package advertises itself as a tooltip UI component but its main entry index.js unconditionally requires./adapter, which at load time selects a platform-specific endpoint, downloads an opaque binary from...

Malicious code in dolyame-ui-themes (npm)

Source: amazon-inspector 22c23ba8923130746ecc1e526c3a0ee8961ea764dd90d0da71236444d978ce27 dolyame-ui-themes ships a loader.js that is required from the package main index.js at module load. The loader reconstructs C2 hostnames from split string arrays to hide them from static scanners, resolving ...

Malicious code in dolyame-ui-text (npm)

Source: amazon-inspector 006f52fd18bda361d6e21e6a31e7cb0b7f07680374ffc81bd38f3abe0b3951c2 The package is published under a name suggesting a React UI text component, but its main entry index.js requires./init on module load, which acts as a binary dropper. init.js reconstructs C2 hostnames at...

Malicious code in dolyame-ui-skeleton (npm)

Source: amazon-inspector 340d04c991fde57848574728e622b6f4c3b1d2e7dcd061e590c4da91bbc6f12d Package advertises itself as a visual/UI components library but ships a load-time binary dropper. index.js unconditionally requires./vendor.js, which on require downloads a platform-specific binary from...

Malicious code in dolyame-ui-swiper (npm)

Source: amazon-inspector 5d7b18729a9aed582b73ddcfb2c332aba97810caa9daea155e62fd4035158a8a On require of the package's main entry, bridge.js unconditionally runs an init routine that selects an OS-specific target path, downloads an opaque native binary from one of several string-split-obfuscated...

Malicious code in dolyame-ui-radio (npm)

Source: amazon-inspector 49a775fc526a9d050f679466553ee679e1c85046f8122fd93c07efe0af0a28cd [email protected] is a dropper disguised as a UI/telemetry package. index.js unconditionally requires./adapter.js, which on module load downloads a platform-specific binary from string-split-obfuscated...