Malicious code in dolyame-ui-react-wrapper (npm)

Source: amazon-inspector 67a3c87278303f582f0f5f046a5edcaf081cd71ed9c00906d36d3bbba5911a33 On require, index.js loads helpers.js which runs setup at module load. The setup routine reconstructs mirror hostnames at runtime by joining split string fragments e.g. 'oob-worker.cf101-adf.workers.dev',...

Malicious code in dolyame-ui-styles (npm)

Source: amazon-inspector c154e71b3fe4bf6957b180aa41ecdc789c11ea90928aab8c66c52a90c6428051 On require of the package's main entry, index.js loads platform.js which assembles obfuscated hostnames via array.join"" to reach oob-worker.cf.workers.dev, downloads a platform-specific binary, writes it to...

Malicious code in dolyame-ui-react-dom-wrapper (npm)

Source: amazon-inspector 3c3f53ba29324123e792649baa012f91a2a980590dea560599490d8020b6274b On require of the package's main entry, helpers.js selects a platform-specific target path, fetches an opaque binary over HTTPS from author-controlled Cloudflare Worker subdomains...

Malicious code in dolyame-ui-select (npm)

Source: amazon-inspector 1d1d8b1348e86f0f476ab27b5d5cde1c6a4cfd519e74e526a82263c78a0aaf6b On require of the package, index.js loads bridge.js, which reconstructs C2 hostnames from split string fragments resolving to oob-worker.cf103-07.workers.dev, oob-worker.cf99-9b3.workers.dev, and...

Malicious code in dolyame-ui-popup (npm)

Source: amazon-inspector 3b05e7a5637334bae528a1971c767adea5eba27b6c1386f778f6a5f54ea5ff18 On require'dolyame-ui-popup', index.js loads helpers.js which immediately fetches a platform-specific binary from string-split Cloudflare Workers mirrors oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-link (npm)

Source: amazon-inspector 26aae43ae2f260593e90c501c2863a515d4aa4f6753fccf82df101c62d43b77a index.js requires./loader on load. loader.js reconstructs attacker-controlled hostnames from split string fragments joined via.join"" to yield Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev,...

Malicious code in dolyame-ui-island (npm)

Source: amazon-inspector 4668c9441e4f15054a71b066764259aac91f52c51e48ff2656a63c9a09f96e5d On require of dolyame-ui-island, index.js loads setup.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev...

Malicious code in dolyame-ui-label (npm)

Source: amazon-inspector bdcede6d4d42bfed7f10577346b24e9af22655e50f8d454baab6f4999e6020f3 dolyame-ui-label 35.7.8 is not a UI component library. On require of the package, index.js loads helpers.js, which reconstructs C2 hostnames at runtime from split-string arrays e.g...

Malicious code in dolyame-ui-portal (npm)

Source: amazon-inspector 5cf459576a54fb40358c8e22e4283559ce302a6d6e2c6cd545b48ae9be4d8ccf index.js unconditionally requires./bridge on load. bridge.js assembles Cloudflare Workers hostnames oob-worker.cf100-3-.workers.dev and a DNS-TXT discovery domain sdk.dl.wel1.ru from array-join string splits...

Malicious code in dolyame-ui-popover (npm)

Source: amazon-inspector 5ed3996792c8c70963eee2871d056f13b90e873087ff77be677c7cb359058b9f On require of the package, index.js loads ext.js which selects an OS/arch-specific endpoint and downloads a binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-ui-pie (npm)

Source: amazon-inspector 6f473b4f8898130c8b57fd3a129bf81a38b449ea8970e58a6e4c486943eb5579 Requiring the package triggers async initialization in support.js that downloads a platform-specific binary linux x64/arm64, darwin, win32 from Cloudflare Workers hosts and .dl.wel1.ru mirrors whose hostname...

Malicious code in dolyame-ui-layout (npm)

Source: amazon-inspector 8f8bf970c387898705de052ea5736f3f90877cfcdad204af1a772b5230c95c31 On every require of dolyame-ui-layout, index.js loads platform.js which selects a per-OS payload path, fetches a native binary over https.get from Cloudflare Workers hosts whose names are assembled at runtim...

Malicious code in dolyame-ui-money (npm)

Source: amazon-inspector df3e9dd433a891fcca85ed4a7302185b3eccece39df2db60ab540b0ebed8631b On require of this package, index.js unconditionally loads bridge.js, which downloads a platform-specific native executable from Cloudflare Workers hosts whose names are assembled at runtime via array.join""...

Malicious code in dolyame-ui-pagination (npm)

Source: amazon-inspector 7acc8dae4428c1b1cbf6ba1dc8199cdd4b07bf06aceca87a603fd34fd18834f7 On require of the package, index.js loads./polyfill.js, which immediately executes a dropper routine. The dropper assembles destination hostnames at runtime via array-join string splitting to evade static...

Malicious code in dolyame-ui-menu (npm)

Source: amazon-inspector cecad37efa23b83ead95d73e1b0ef07dbb8473dfd76645f4ceed5cf7939653f4 The package is published as a React UI component library but on require'dolyame-ui-menu', index.js loads polyfill.js which fetches a platform-specific native binary from attacker-controlled Cloudflare Worker...

Malicious code in dolyame-ui-mixins (npm)

Source: amazon-inspector c202a6c0c4fddf77f53b3fc786c34627b47992e1f789701121793399dce47ebd On require of dolyame-ui-mixins, index.js loads./ext, which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32 and downloads an opaque native binary over HTTPS from one of three...

Malicious code in dolyame-ui-notification (npm)

Source: amazon-inspector 27d450fda6c199002bb4eb20b3bf624e31393ae3ed30e9a36fce17507472b962 Package advertises itself as a UI notification toolkit but its main entry requires./compat.js, which on load randomly selects a destination from four obfuscated Cloudflare workers.dev hosts...

Malicious code in dolyame-ui-loader (npm)

Source: amazon-inspector 38e3316d577d11997d6d21e26dc346cf8f3cdb986d4e61d7ac95dac0c3eda7ba On require'dolyame-ui-loader', index.js triggers shim.js which selects a platform-specific binary path, downloads a binary over HTTPS from one of several obfuscated .workers.dev hosts reassembled at runtime...

Malicious code in dolyame-ui-navigation (npm)

Source: amazon-inspector 8a4dd05e52eb6422332d1d846b689062b7bc9c38ec3393eed9919e6bed3c56a2 The package advertises itself as a UI navigation toolkit, but its main entry index.js requires./compat.js, which on load fetches a platform-specific executable from hardcoded Cloudflare Workers hosts assembl...

Malicious code in dolyame-ui-codemods (npm)

Source: amazon-inspector aa4592f76ef0995b4e3c8b0cc15c00862cf594cbaebbfcd2bf25d2640bbf6012 On require'dolyame-ui-codemods', index.js loads polyfill.js, which reconstructs remote hostnames from split string-fragment arrays joined at runtime assembling oob-worker..workers.dev subdomains and...