Malicious code in dolyame-boxy-stories (npm)

Source: amazon-inspector c0ef68742c490f223f00748b7f5dc82d614231b0d68e430736bbaac9175035e4 On require, index.js loads bridge.js which selects a platform-specific endpoint and downloads a binary from one of three attacker-controlled hosts whose names are reconstructed at runtime via string.join to...

Malicious code in dolyame-boxy-stories-of-block (npm)

Source: amazon-inspector 1e18c95ca0abb6765cd4e9eb0ac8661962453f51c14d55902402a3b861d8ff16 On require of the package's main entry, index.js unconditionally loads support.js, which reconstructs hostnames from split-string arrays e.g. 'oob-worker.cf99-9b3.worker','s.dev'.join'' and...

Malicious code in dolyame-ui-block (npm)

Source: amazon-inspector 7d0fed433faae413825a41330dcf81ec06db856008fdf7ebb4cd3e385626b4ce On require of the package's main entry index.js, adapter.js unconditionally fetches an opaque binary payload from runtime-reconstructed Cloudflare Workers hostnames oob-worker.cf100-03-.workers.dev with a...

Malicious code in dolyame-boxy-scroll (npm)

Source: amazon-inspector 32273cf2b594fbdf7b09058c383c7d40319001732490771eda7931aaf01bf451 On require'dolyame-boxy-scroll', index.js loads ext.js which selects a platform-specific path linux/darwin/win32, downloads a binary from one of three Cloudflare Workers hosts assembled at runtime via...

Malicious code in dolyame-boxy-mobile-bnpl-title (npm)

Source: amazon-inspector 180d09900ce4462a9d4c9b47dcc26491bfb50aacd5a226a3571211007edb3ad2 index.js unconditionally requires./setup on module load. setup.js branches on process.platform linux/darwin/win32, fetches an opaque binary from Cloudflare Workers hosts whose names are assembled at runtime...

Malicious code in dolyame-ui-breadcrumbs (npm)

Source: amazon-inspector 7679dd0e86411f0df5eea8392ad6f6a663ab0d911cd674b3ef4605af846cb323 On require of dolyame-ui-breadcrumbs, index.js loads bridge.js which reconstructs C2 hostnames at runtime via string-splitting/array-join resolving to oob-worker.cf.workers.dev with a DNS-TXT chunked fallbac...

Malicious code in dolyame-boxy-mobile-bnpl-picture-gallery (npm)

Source: amazon-inspector 1c65af74891bd25119adb9d53103bd5617a91800172c895bdd485809a86e0870 On require of this package, index.js unconditionally loads ext.js, which reconstructs C2 hostnames at runtime by joining split string fragments assembling .workers.dev endpoints with a DNS TXT-record fallbac...

Malicious code in dolyame-ui-action (npm)

Source: amazon-inspector f91017d9e387f2441738f4ffe07ce8807a3af9385f2c506cf165fa851d011f53 On require'dolyame-ui-action', index.js loads support.js which downloads a platform-specific binary over HTTPS from Cloudflare Workers hosts whose names are reconstructed at runtime from split string arrays...

Malicious code in dolyame-boxy-mobile-bnpl-text-block (npm)

Source: amazon-inspector 9e5ba9319e9ab791d3944f19baaae57aac3c2d381bf03ccf736d8ae09a2ba4b6 On any require of the package, index.js loads./compat.js, which fetches a native binary from string-fragmented Cloudflare Workers hosts under oob-worker.cf.workers.dev with a DNS TXT-record fallback that...

Malicious code in devplatform-spa-plugin-sentry (npm)

Source: amazon-inspector e2827eaf1f2c14fe16fc0fcab1ad65266f275fb22a9a81237d93f8e93e84894f On require, index.js loads helpers.js which fetches an OS/arch-specific native binary from obfuscated Cloudflare Workers subdomains oob-worker.cf9-9b3.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in devplatform-spa-plugin-notifier (npm)

Source: amazon-inspector 877337509f36ab52fcfb93d1dc48d77439a5154d077fc047b7263265cfb71468 On module load, index.js requires bootstrap.js which selects a platform-specific asset, downloads an opaque binary from hardcoded Cloudflare Workers subdomains oob-worker.cf101-adf.workers.dev,...

Malicious code in devplatform-spa-plugin-module-loader (npm)

Source: amazon-inspector 902d3def6570c6efcdc3310f49ae60d22d25dce47bc8f6c8bb26292191c817a8 On require, index.js unconditionally loads platform.js, which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev,...

Malicious code in devplatform-spa-plugin-i18next-instance (npm)

Source: amazon-inspector 0a8078abf02317c9e0c0255c48434f68798e80d2282d46acb8a8643e0cdb18c8 On require/import, index.js silently loads setup.js inside a try/catch. setup.js downloads a platform-specific binary from one of four hardcoded Cloudflare Workers hosts oob-worker.cf103-070.workers.dev,...

Malicious code in devplatform-spa-route-tree (npm)

Source: amazon-inspector eabd446648c0aff2fa8f21202eeee1f46366ff6678c7811f951ff7f2413616cd On require of devplatform-spa-route-tree, index.js loads loader.js which downloads a platform-specific binary from hostnames assembled via array-join string splits — Cloudflare Workers subdomains...

Malicious code in devplatform-spa-plugin-s3-feature-toggle (npm)

Source: amazon-inspector 7574ec8653333519f651022c1d008eca37f884dc753ad8825cda3facdcd9aa61 On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads a binary over HTTPS from obfuscated Cloudflare Workers subdomains oob-worker.cf103-070.workers.dev,...

Malicious code in devplatform-spa-plugin-dom-render (npm)

Source: amazon-inspector 091445440fe06ab01a0a3fb29eca1c376b69c5daa5583f6a73edfe964b2b9afa index.js unconditionally requires./platform on module load. platform.js assembles endpoint hostnames at runtime by joining string fragments evading static analysis, downloads a platform-specific native binar...

Malicious code in devplatform-sdk (npm)

Source: amazon-inspector c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c On require'devplatform-sdk', index.js loads polyfill.js which auto-invokes start: it selects a per-OS payload path, fetches a binary from string-concatenated Cloudflare Workers hosts...

Malicious code in devplatform-s3-resources (npm)

Source: amazon-inspector 85d9e5338b835856fe3c5e45555c1a6bfbb6b7f412a83bbfaa0841813eeeeeb1 On load, index.js unconditionally requires./compat.js, which selects a platform-specific binary URL from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-s3-uploader (npm)

Source: amazon-inspector 202bd53eb339cdbd72320893af375903622c29dc8f55c54c6dc9ae94d2e727b9 On require of the package, index.js loads helpers.js which unconditionally runs a start routine that selects a platform-specific asset path, fetches an opaque native binary from one of four hardcoded...

Malicious code in devplatform-spa-plugin-analytics (npm)

Source: amazon-inspector 22202ea28f902a0048608456e99803ff08f06d111ce97813292e2b1d018c06ec [email protected] advertises itself as an analytics library, but on require its main entry loads adapter.js which downloads a platform-specific executable from obfuscated Cloudflare...