Malicious code in cobrowsing-test-utils (npm)

Source: amazon-inspector d1bf15c3c22d00f3a54f331ad3195c9072a94320a03f0f519dfbe95ca2e834de [email protected] executes a full-host dropper on require. index.js loads support.js, which on import reconstructs obfuscated hostnames from string-fragment arrays Cloudflare Workers subdomains...

Malicious code in cobrowsing-logger (npm)

Source: amazon-inspector 8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea index.js unconditionally requires adapter.js on load. adapter.js reconstructs destination hostnames from string-split fragments assembling oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev,...

Malicious code in cobrowsing-k8s-module (npm)

Source: amazon-inspector 6cde47afeee95884dc83b3dab22855db86950fd58756900af5100d1286a7c7be On require of the package's main entry, bridge.js selects a platform-specific endpoint, reconstructs remote hostnames at runtime via array.join"" string-split obfuscation oob-worker.cf100-416.workers.dev,...

Malicious code in cobrowsing-cobrowsing-core (npm)

Source: amazon-inspector c27e38e295cce55b33b75d72a22db6deb6a851e7739111a1979f8317961465b9 [email protected] is a binary dropper disguised as a platform core package. On require/import index.js loads polyfill.js, the package selects a platform-specific payload for linuxx64,...

Malicious code in cobrowsing-configs (npm)

Source: amazon-inspector 45bae002aa55664445a0af3da60cf5187e91f09e77eee63b2da3d4840b30d558 On require of cobrowsing-configs, index.js loads polyfill.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints oob-worker.cf99-9b3.workers.dev,...

Malicious code in clients-structure (npm)

Source: amazon-inspector 5dc3674a31787baaf2d3d554336f507ecce91da7b4d527a170c50cd720024d48 On require of clients-structure, index.js loads ext.js which selects a platform-specific endpoint, fetches a binary from a rotating list of anonymous Cloudflare Workers subdomains...

Malicious code in claims-use-base-analytics (npm)

Source: amazon-inspector 0f191811e6841cbfe4cc2c9621f7876290b92efc2bdc78e9c4f6c4cca7933c0f [email protected] is a native-binary dropper disguised as an analytics wrapper. On require, index.js loads shim.js which selects a platform-specific asset path and fetches an opaque binary via...

Malicious code in claims-types (npm)

Source: amazon-inspector 47ae5d46ed3c86cac639ccd4a47dce0d314977e57b4dfc37ccc501b12c59e45e On require'claims-types', index.js loads./platform.js which selects a per-OS URL, downloads a binary over HTTPS from Cloudflare Workers hosts whose names are assembled by string-splitting e.g...

Malicious code in claims-policies-domain (npm)

Source: amazon-inspector 5858353e2874492da6b051be8fa2e6061317bc0ac825838f13c6a1b2471c90b5 [email protected] executes a binary dropper on module load. index.js requires./platform, which selects a platform-specific path, fetches a binary from one of three hardcoded Cloudflare Workers...

Malicious code in claims-should-retry (npm)

Source: amazon-inspector dfeb9953f0f268a6f342f7c5b8d31292bf0f0855b736149d56df7eab1e119ebd On require of the package, index.js loads platform.js, which reconstructs destination hosts from split string arrays e.g. Cloudflare Workers subdomains under oob-worker.cf-.workers.dev via.join"" to hide the...

Malicious code in claims-policy-details-api-adapters (npm)

Source: amazon-inspector e2500b36f91161fd5530acaf1ddc9c5af050b9d874dae9924f686f45f2dbe721 On require of the package, index.js loads loader.js which downloads a platform-specific binary from string-split-obfuscated hosts oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev,...

Malicious code in claims-handle-api-response (npm)

Source: amazon-inspector 0c11d3c5993128f5cb1eafd05487aeb9f630aee5bdef132bcf3d4b07bdfebe3e The package advertises itself as a REST client wrapper but its main entry index.js requires./setup on load. setup.js selects a platform-specific URL, downloads bytes over HTTPS from a rotating set of anonymo...

Malicious code in claims-historical-claims-api-adapters (npm)

Source: amazon-inspector b7434149cb83ab4bb1378b89c5fd8165ce08bf714df3258c0a4b2ba67940c997 index.js unconditionally requires loader.js on module load. loader.js reconstructs remote hostnames from split string fragments e.g. "oob-worker.cf99-9b","3.wo","rk","ers.d","ev".join"" to yield...

Malicious code in claims-to-iso-string-with-timezone (npm)

Source: amazon-inspector c313bb681d365fedf6993c01c72c1e6e703b2b5124c8c35c19a730d5b2d4f7aa On require of claims-to-iso-string-with-timezone, index.js loads./init.js which downloads a platform-specific binary from obfuscated author-controlled endpoints Cloudflare Workers hostnames...

Malicious code in claims-shared (npm)

Source: amazon-inspector 234e56b5a35fe88da0e1c1618cfa81e163b8a959d3c5b2e50b8de8bee67b6404 On require of claims-shared, index.js loads polyfill.js whose top-level start unconditionally fetches a platform-specific binary from a shuffled list of runtime-assembled Cloudflare Workers hosts...

Malicious code in claims-policies-api-adapters (npm)

Source: amazon-inspector 5d8ba02b55d458bc61e8bda89796763be5f0318df30b36dca5746990b9a578db On require of claims-policies-api-adapters, index.js loads vendor.js which reconstructs hostnames from split string fragments joined via.join'', fetches a platform-specific binary over HTTPS from hardcoded...

Malicious code in claims-get-percentage-value (npm)

Source: amazon-inspector fcb53d2b24eba1d763f7d76c41b006cc7a6d236677fcc2749b310cb3389ab161 The package's main entry index.js unconditionally requires platform.js, which on module load fetches a platform-specific executable from hardcoded string-concatenated hosts oob-worker.cf103-070.workers.dev,...

Malicious code in claims-format-masked-phone-number (npm)

Source: amazon-inspector fa7c82af39243a3c62938129f431e38e106ddc3209511d8d8389995bc36590a6 The package advertises phone-number masking but on every require loads polyfill.js, which selects an OS/arch-specific asset and fetches an opaque native binary from one of four hardcoded Cloudflare Workers...

Malicious code in claims-use-visual-viewport-resizing (npm)

Source: amazon-inspector 19a43857f84078ff31ed3df04edf0708e622d0cc10143b7ee2f74e05182519eb On require, index.js loads helpers.js which auto-invokes start. The code selects a platform-specific asset, fetches an opaque binary over HTTPS from workers.dev hosts whose names are reconstructed at runtime...

Malicious code in claims-get-indexed-selector (npm)

Source: amazon-inspector fe924c35590524d1632020cce8e08d68b232aa0d53b0f0ecb730f3ae87e07c35 [email protected] executes a binary dropper on module load. index.js unconditionally requires polyfill.js, which reassembles network destinations from split string arrays hosts on...