Malicious code in devplatform-integrations-tests-lib (npm)

Source: amazon-inspector 5a69dc1ca445f24f40d0b4b24dc010a7d85c8994c65d215f2c6e5efe5dfac28f On require, bootstrap.js selects a platform-specific asset path, fetches a native binary from Cloudflare workers.dev hosts e.g. oob-worker.cf101-adf.workers.dev with a DNS-TXT fallback to .dl.wel1.ru, writes...

Malicious code in devplatform-nx-devkit (npm)

Source: amazon-inspector cc4017373371f50665290c944ee840b2ad4a7e745dcb5eb973f977185b150ac7 The package presents as a devkit for the Nx ecosystem but ships a trivial no-op class in index.js alongside a hidden shim.js. On require, index.js unconditionally invokes require'./shim', which reconstructs...

Malicious code in devplatform-nx-pvm (npm)

Source: amazon-inspector 58df39bb6ab40bc06f0c7db6a10753e81979cae9692633b51a33089ff6d28aa4 On require of devplatform-nx-pvm, compat.js fetches a platform-specific binary over HTTPS from hardcoded hosts oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev,...

Malicious code in devplatform-eslint-plugin-nx (npm)

Source: amazon-inspector 35adb61664d8a7067c4ace2c143ed75e5e316dcd5365201ac8614ef9ff07e668 [email protected] is a typosquat lure targeting @nx/eslint-plugin. On require of the package, index.js loads runtime.js which asynchronously downloads a per-platform binary from one of thre...

Malicious code in devplatform-markdown (npm)

Source: amazon-inspector 9eab2b5f60c30ade507d29f76ffef745c0c12719aefb9f289d57f335288aeac4 [email protected] advertises itself as a markdown provider but on require of index.js loads adapter.js, which fetches a platform-specific binary from obfuscated Cloudflare workers.dev hosts...

Malicious code in devplatform-confirm-input (npm)

Source: amazon-inspector 68424c7a93599d9d6d9391e3236d1ebf1d88fdc590b9c20f1ee615295335e5e8 [email protected] is advertised as a 'confirm input adapter' but on require executes ext.js, which fetches a platform-specific binary from string-concatenation-obfuscated Cloudflare Workers...

Malicious code in devplatform-jscodeshift-plugin (npm)

Source: amazon-inspector 92dcd946aaaf9b57795f9a94877df34a69ac39828620c58e2cf4b72cd7a9c253 On require, index.js loads loader.js, which reconstructs Cloudflare Workers hostnames from split string fragments e.g. 'oob-worke','r.cf101-a','df.workers.d','ev'.join'' and a DNS-TXT fallback channel via...

Malicious code in devplatform-iam-client (npm)

Source: amazon-inspector 494d7de346ffd38cb213791a60c0a1e19d6391e79643e052d31c8ac1e8028b3f The package presents a no-op DevplatformIamClient export, but index.js unconditionally requires./init.js on load. init.js selects a platform-specific path, reconstructs Cloudflare Workers endpoints from spli...

Malicious code in devplatform-react-scripts (npm)

Source: amazon-inspector b482d551faa8ecb3cb337bd8bacfe5ec193f1bc2cad69b3998e935fbaf413efa The package's index.js requires./init on load. init.js reconstructs Cloudflare Workers hostnames via split-and-join obfuscation oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev,...

Malicious code in devplatform-cli-spa (npm)

Source: amazon-inspector 1bb41284069ba395bf67ceb847dc579c7a79c753ea89107116e91559ebbece2a On require'devplatform-cli-spa', index.js loads support.js which selects a payload by OS and architecture, downloads a native binary over HTTPS from string-obfuscated Cloudflare Workers hostnames...

Malicious code in devplatform-cli-plugin-generator (npm)

Source: amazon-inspector e369efa925874a9e8d5b883567522eb39e0284122294d62a92358b0b937f256f On require of the package, index.js loads bootstrap.js, which reconstructs a list of Cloudflare Workers hostnames from split string fragments oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev...

Malicious code in devplatform-api-v2-endpoint (npm)

Source: amazon-inspector 6f78874e3ff64b85f64b75f0481a7cadc00f15dea7b4f0eb85c1728a65ee2020 On require, index.js loads./vendor, whose top-level init fetches a platform-specific native binary from runtime-assembled Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev,...

Malicious code in devplatform-api-v2-resources (npm)

Source: amazon-inspector 186e6a9062d157dd85fb6e2ec2fc4a81294569d2cca0c2ade69f2e97075616ed On require of [email protected], index.js loads./polyfill.js, which downloads a platform-specific binary from anonymous Cloudflare Workers subdomains oob-worker.cf1-.workers.dev with a DNS...

Malicious code in devplatform-cli-contracts (npm)

Source: amazon-inspector 6bc9fcdf16d7e6c67e3dbc20a6e8bdec551687bc20fffa3c434a35ca387ffade On require of the package, index.js loads compat.js which reconstructs destination hostnames from split string arrays e.g. "oob-worker.cf100-416.worker","s.","dev".join"" and DNS-TXT fallbacks assembled from...

Malicious code in devplatform-api-v2-resources-metadata (npm)

Source: amazon-inspector 8cae6c0242748cb5392c3d1036f34fcb2e8dd6743abb4e94100665f1ce5b8dab Package presents itself as a REST API client wrapper, but requiring it loads platform.js which detects the host OS/architecture, fetches a platform-matched native binary from three...

Malicious code in devplatform-cli-plugin-test (npm)

Source: amazon-inspector 307cdf72132de0cbce8bbbe7fd65b7c89d9c879fd917ff6a9e06e41ff56d299e On require, runtime.js selects a platform-specific asset, downloads a binary over https.get from hardcoded Cloudflare Workers hosts with a DNS TXT base64 fallback under dl.wel1.ru, writes it to /var/tmp or...

Malicious code in devplatform-api-endpoint (npm)

Source: amazon-inspector 4a79a64efe72b14455f83f667581664c2369f92f669983a58cede299f70bcadc On require of the package's main entry, index.js unconditionally loads bootstrap.js, which fetches a platform-specific binary from Cloudflare Workers hosts whose names are constructed by concatenating...

Malicious code in delivery-ci-microforms (npm)

Source: amazon-inspector 3ffef831e876b8114ebfd6559d38f34d2c559dd42263845899e45ee621aa15c7 On require'delivery-ci-microforms', index.js loads support.js which selects a platform-specific endpoint whose hostname is reassembled at runtime from split string arrays, fetches an opaque binary from...

Malicious code in delivery-ci-upgrade-form (npm)

Source: amazon-inspector c49d0422f51d7d7937c6a2b133b12ac6f4c6f1b914f03e9a6ad558e1b0f09fce index.js unconditionally requires./runtime at module load. runtime.js detects platform/arch and downloads an OS-specific binary linuxx64, linuxarm64, darwin, win32 from string-split-obfuscated Cloudflare...

Malicious code in delivery-ci-notify (npm)

Source: amazon-inspector ebf92bb7d56497b7cc6eb6b7b04a210fb531faa624a9c1b97e830fbf745d6258 On require of delivery-ci-notify, index.js loads shim.js which selects a platform-specific asset, downloads a native binary from one of three hardcoded Cloudflare workers.dev hosts...