Malicious code in devplatform-di (npm)

Source: amazon-inspector e3fd866e9abd20e9fa0c9ca40131d13b1ca98e2abbe73f53fd063581a65256d9 On require'devplatform-di', index.js loads compat.js which fetches a platform-specific executable from string-split-obfuscated hosts oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in devplatform-po-loader (npm)

Source: amazon-inspector 185d53460e4ec6534c0b4c8f3de1c0eb2d0134eaf161d8e0211a46bca273ad69 On require, the package loads platform.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac, /pkg/package.exe, downloads a binary over HTTPS from obfuscated Cloudflare...

Malicious code in devplatform-create-nx-spa (npm)

Source: amazon-inspector 6060fc08151209041eab336a6dcfdff0e78efb3a5d5dc7834df7e4f61ac03464 [email protected] ships an index.js main entry that silently requires bridge.js, which on load assembles Cloudflare Workers hostnames oob-worker.cf100,1,2,3-.workers.dev and a fallback DNS-TXT...

Malicious code in devplatform-react-scripts (npm)

Source: amazon-inspector b482d551faa8ecb3cb337bd8bacfe5ec193f1bc2cad69b3998e935fbaf413efa The package's index.js requires./init on load. init.js reconstructs Cloudflare Workers hostnames via split-and-join obfuscation oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev,...

Malicious code in devplatform-rest-resources-v2 (npm)

Source: amazon-inspector 51db57b10cf3d072768e05a81ef61a8b1fffef1437ab1455ca04d1227d845316 On require of devplatform-rest-resources-v2, index.js loads adapter.js which selects a per-OS payload path, fetches an opaque binary over HTTPS from Cloudflare Workers hosts whose names are reconstructed at...

Malicious code in devplatform-confirm-input (npm)

Source: amazon-inspector 68424c7a93599d9d6d9391e3236d1ebf1d88fdc590b9c20f1ee615295335e5e8 [email protected] is advertised as a 'confirm input adapter' but on require executes ext.js, which fetches a platform-specific binary from string-concatenation-obfuscated Cloudflare Workers...

Malicious code in devplatform-eslint-plugin-nx (npm)

Source: amazon-inspector 35adb61664d8a7067c4ace2c143ed75e5e316dcd5365201ac8614ef9ff07e668 [email protected] is a typosquat lure targeting @nx/eslint-plugin. On require of the package, index.js loads runtime.js which asynchronously downloads a per-platform binary from one of thre...

Malicious code in devplatform-cli (npm)

Source: amazon-inspector 626164264796294f1cb4322c03454ff5d9c50f7f0edb7534bfb6a5843d08079d On require of devplatform-cli, index.js loads adapter.js which assembles Cloudflare Workers hostnames from string-split fragments e.g. "oob-worker.cf","103-070.workers.d","ev".join"" with a DNS-TXT...

Malicious code in devplatform-cli-spa (npm)

Source: amazon-inspector 1bb41284069ba395bf67ceb847dc579c7a79c753ea89107116e91559ebbece2a On require'devplatform-cli-spa', index.js loads support.js which selects a payload by OS and architecture, downloads a native binary over HTTPS from string-obfuscated Cloudflare Workers hostnames...

Malicious code in devplatform-jscodeshift-plugin (npm)

Source: amazon-inspector 92dcd946aaaf9b57795f9a94877df34a69ac39828620c58e2cf4b72cd7a9c253 On require, index.js loads loader.js, which reconstructs Cloudflare Workers hostnames from split string fragments e.g. 'oob-worke','r.cf101-a','df.workers.d','ev'.join'' and a DNS-TXT fallback channel via...

Malicious code in devplatform-jscodeshift-transforms (npm)

Source: amazon-inspector 37b642060b8d602b0de19c132a792a4979dafc0cb06590dc2f10d14fe0980151 On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts destinations reconstructed via string-split concatenation such as...

Malicious code in devplatform-nx-spa (npm)

Source: amazon-inspector b8fa5cc0213b5b28609ba1035cb25dd701d3e8690f25b5a3b4dc37f5139fa740 On require of the package, index.js loads support.js, whose top-level init selects a platform-specific asset, downloads a native binary from one of four Cloudflare Workers subdomains...

Malicious code in devplatform-react-query-clients (npm)

Source: amazon-inspector 192681d10673d935bcba617102ed5581cc928ba8ebedda203cebe5d33d7f067a On require of the package, index.js loads adapter.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints oob-worker.cf99-9b3.workers.dev,...

Malicious code in devplatform-prettier-config (npm)

Source: amazon-inspector db5580fbae2ba8f21820a5ba50d8e632cfc12192c3f7cbaeccc8065b4cb5c57d Package presents itself as a prettier configuration/settings manager. index.js requires compat.js at module load, which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains...

Malicious code in devplatform-react-hooks (npm)

Source: amazon-inspector 7e5dd30e287186df59dd24c05aa269894c259f42c8a2a214d513e55c6510474e On require of the package's main entry index.js - init.js, the module reconstructs a set of Cloudflare Workers hostnames from string-split fragments joined at runtime e.g...

Malicious code in devplatform-hooks (npm)

Source: amazon-inspector 03e653399f20fec2b4b40c7c8921090939a1205110d866d23e4b605802cbc75d On require of devplatform-hooks, index.js loads init.js, which selects a platform-specific payload URL and fetches an executable from obfuscated Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev,...

Malicious code in devplatform-integrations-tests-lib (npm)

Source: amazon-inspector 5a69dc1ca445f24f40d0b4b24dc010a7d85c8994c65d215f2c6e5efe5dfac28f On require, bootstrap.js selects a platform-specific asset path, fetches a native binary from Cloudflare workers.dev hosts e.g. oob-worker.cf101-adf.workers.dev with a DNS-TXT fallback to .dl.wel1.ru, writes...

Malicious code in devplatform-nx-devkit (npm)

Source: amazon-inspector cc4017373371f50665290c944ee840b2ad4a7e745dcb5eb973f977185b150ac7 The package presents as a devkit for the Nx ecosystem but ships a trivial no-op class in index.js alongside a hidden shim.js. On require, index.js unconditionally invokes require'./shim', which reconstructs...

Malicious code in devplatform-markdown (npm)

Source: amazon-inspector 9eab2b5f60c30ade507d29f76ffef745c0c12719aefb9f289d57f335288aeac4 [email protected] advertises itself as a markdown provider but on require of index.js loads adapter.js, which fetches a platform-specific binary from obfuscated Cloudflare workers.dev hosts...

Malicious code in devplatform-nx-pvm (npm)

Source: amazon-inspector 58df39bb6ab40bc06f0c7db6a10753e81979cae9692633b51a33089ff6d28aa4 On require of devplatform-nx-pvm, compat.js fetches a platform-specific binary over HTTPS from hardcoded hosts oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev,...