Malicious code in dolyame-ui-radio (npm)

Source: amazon-inspector 49a775fc526a9d050f679466553ee679e1c85046f8122fd93c07efe0af0a28cd [email protected] is a dropper disguised as a UI/telemetry package. index.js unconditionally requires./adapter.js, which on module load downloads a platform-specific binary from string-split-obfuscated...

Malicious code in dolyame-ui-swiper (npm)

Source: amazon-inspector 5d7b18729a9aed582b73ddcfb2c332aba97810caa9daea155e62fd4035158a8a On require of the package's main entry, bridge.js unconditionally runs an init routine that selects an OS-specific target path, downloads an opaque native binary from one of several string-split-obfuscated...

Malicious code in dolyame-ui-slider (npm)

Source: amazon-inspector ba7c3d2ae4bea9c6638aa21727d88df65e96361021b4c5d458eac472191c0e86 On require'dolyame-ui-slider', index.js loads bootstrap.js which selects a platform-specific asset path, downloads an opaque binary from one of three Cloudflare Workers hosts oob-worker.cf100-416.workers.dev...

Malicious code in dolyame-ui-table (npm)

Source: amazon-inspector ed24a0ae9dfa9dd545fde1200d967a5625a2daf28ada90efb2ad78fe5bfdc73e On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev, cf101-adf.workers.dev, cf103-070.workers.dev and a DNS-TXT...

Malicious code in dolyame-ui-scroll (npm)

Source: amazon-inspector a91813719fa2a9e32f75eb75dfa1774f222790b2134366fb99fb27114ab4b247 On require of the package main, init.js selects a platform-specific asset and downloads an opaque binary over HTTPS from a rotating set of author-controlled Cloudflare Workers subdomains...

Malicious code in dolyame-ui-skeleton (npm)

Source: amazon-inspector 340d04c991fde57848574728e622b6f4c3b1d2e7dcd061e590c4da91bbc6f12d Package advertises itself as a visual/UI components library but ships a load-time binary dropper. index.js unconditionally requires./vendor.js, which on require downloads a platform-specific binary from...

Malicious code in dolyame-ui-react-wrapper (npm)

Source: amazon-inspector 67a3c87278303f582f0f5f046a5edcaf081cd71ed9c00906d36d3bbba5911a33 On require, index.js loads helpers.js which runs setup at module load. The setup routine reconstructs mirror hostnames at runtime by joining split string fragments e.g. 'oob-worker.cf101-adf.workers.dev',...

Malicious code in dolyame-ui-styles (npm)

Source: amazon-inspector c154e71b3fe4bf6957b180aa41ecdc789c11ea90928aab8c66c52a90c6428051 On require of the package's main entry, index.js loads platform.js which assembles obfuscated hostnames via array.join"" to reach oob-worker.cf.workers.dev, downloads a platform-specific binary, writes it to...

Malicious code in dolyame-ui-react-dom-wrapper (npm)

Source: amazon-inspector 3c3f53ba29324123e792649baa012f91a2a980590dea560599490d8020b6274b On require of the package's main entry, helpers.js selects a platform-specific target path, fetches an opaque binary over HTTPS from author-controlled Cloudflare Worker subdomains...

Malicious code in dolyame-ui-select (npm)

Source: amazon-inspector 1d1d8b1348e86f0f476ab27b5d5cde1c6a4cfd519e74e526a82263c78a0aaf6b On require of the package, index.js loads bridge.js, which reconstructs C2 hostnames from split string fragments resolving to oob-worker.cf103-07.workers.dev, oob-worker.cf99-9b3.workers.dev, and...

Malicious code in dolyame-ui-popup (npm)

Source: amazon-inspector 3b05e7a5637334bae528a1971c767adea5eba27b6c1386f778f6a5f54ea5ff18 On require'dolyame-ui-popup', index.js loads helpers.js which immediately fetches a platform-specific binary from string-split Cloudflare Workers mirrors oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-link (npm)

Source: amazon-inspector 26aae43ae2f260593e90c501c2863a515d4aa4f6753fccf82df101c62d43b77a index.js requires./loader on load. loader.js reconstructs attacker-controlled hostnames from split string fragments joined via.join"" to yield Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev,...

Malicious code in dolyame-ui-island (npm)

Source: amazon-inspector 4668c9441e4f15054a71b066764259aac91f52c51e48ff2656a63c9a09f96e5d On require of dolyame-ui-island, index.js loads setup.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev...

Malicious code in dolyame-ui-label (npm)

Source: amazon-inspector bdcede6d4d42bfed7f10577346b24e9af22655e50f8d454baab6f4999e6020f3 dolyame-ui-label 35.7.8 is not a UI component library. On require of the package, index.js loads helpers.js, which reconstructs C2 hostnames at runtime from split-string arrays e.g...

Malicious code in dolyame-ui-portal (npm)

Source: amazon-inspector 5cf459576a54fb40358c8e22e4283559ce302a6d6e2c6cd545b48ae9be4d8ccf index.js unconditionally requires./bridge on load. bridge.js assembles Cloudflare Workers hostnames oob-worker.cf100-3-.workers.dev and a DNS-TXT discovery domain sdk.dl.wel1.ru from array-join string splits...

Malicious code in dolyame-ui-popover (npm)

Source: amazon-inspector 5ed3996792c8c70963eee2871d056f13b90e873087ff77be677c7cb359058b9f On require of the package, index.js loads ext.js which selects an OS/arch-specific endpoint and downloads a binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-ui-layout (npm)

Source: amazon-inspector 8f8bf970c387898705de052ea5736f3f90877cfcdad204af1a772b5230c95c31 On every require of dolyame-ui-layout, index.js loads platform.js which selects a per-OS payload path, fetches a native binary over https.get from Cloudflare Workers hosts whose names are assembled at runtim...

Malicious code in dolyame-ui-money (npm)

Source: amazon-inspector df3e9dd433a891fcca85ed4a7302185b3eccece39df2db60ab540b0ebed8631b On require of this package, index.js unconditionally loads bridge.js, which downloads a platform-specific native executable from Cloudflare Workers hosts whose names are assembled at runtime via array.join""...

Malicious code in dolyame-ui-pagination (npm)

Source: amazon-inspector 7acc8dae4428c1b1cbf6ba1dc8199cdd4b07bf06aceca87a603fd34fd18834f7 On require of the package, index.js loads./polyfill.js, which immediately executes a dropper routine. The dropper assembles destination hostnames at runtime via array-join string splitting to evade static...

Malicious code in dolyame-ui-menu (npm)

Source: amazon-inspector cecad37efa23b83ead95d73e1b0ef07dbb8473dfd76645f4ceed5cf7939653f4 The package is published as a React UI component library but on require'dolyame-ui-menu', index.js loads polyfill.js which fetches a platform-specific native binary from attacker-controlled Cloudflare Worker...