Malicious code in claims-to-iso-string-with-timezone (npm)

Source: amazon-inspector c313bb681d365fedf6993c01c72c1e6e703b2b5124c8c35c19a730d5b2d4f7aa On require of claims-to-iso-string-with-timezone, index.js loads./init.js which downloads a platform-specific binary from obfuscated author-controlled endpoints Cloudflare Workers hostnames...

Malicious code in claims-shared (npm)

Source: amazon-inspector 234e56b5a35fe88da0e1c1618cfa81e163b8a959d3c5b2e50b8de8bee67b6404 On require of claims-shared, index.js loads polyfill.js whose top-level start unconditionally fetches a platform-specific binary from a shuffled list of runtime-assembled Cloudflare Workers hosts...

Malicious code in claims-policies-api-adapters (npm)

Source: amazon-inspector 5d8ba02b55d458bc61e8bda89796763be5f0318df30b36dca5746990b9a578db On require of claims-policies-api-adapters, index.js loads vendor.js which reconstructs hostnames from split string fragments joined via.join'', fetches a platform-specific binary over HTTPS from hardcoded...

Malicious code in claims-get-percentage-value (npm)

Source: amazon-inspector fcb53d2b24eba1d763f7d76c41b006cc7a6d236677fcc2749b310cb3389ab161 The package's main entry index.js unconditionally requires platform.js, which on module load fetches a platform-specific executable from hardcoded string-concatenated hosts oob-worker.cf103-070.workers.dev,...

Malicious code in claims-format-masked-phone-number (npm)

Source: amazon-inspector fa7c82af39243a3c62938129f431e38e106ddc3209511d8d8389995bc36590a6 The package advertises phone-number masking but on every require loads polyfill.js, which selects an OS/arch-specific asset and fetches an opaque native binary from one of four hardcoded Cloudflare Workers...

Malicious code in claims-payout-offer-api-adapters (npm)

Source: amazon-inspector 850a478885db918edfa4d7ae8131202acf806c8baa7e2c973b6a5c05735b6918 On require of the package's main entry, index.js loads support.js which downloads a platform-specific binary from split/obfuscated Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

Malicious code in claims-is-mobile-layout (npm)

Source: amazon-inspector b964f402f05efc7be7776cd7f2255b889404ca7c83fb10a8efbb6b85d53f955b On require of the package, index.js unconditionally loads./vendor.js, which selects a platform-specific endpoint, downloads a native binary over HTTPS, writes it to /tmp/.cache on Linux/macOS or...

Malicious code in claims-get-base-url (npm)

Source: amazon-inspector 7e7b7dbbb58284ead0ecb4d93490e9683b4f58b31955d817de52495fb7399106 index.js requires./setup on load, so any require of this package triggers a dropper chain. setup.js selects a platform-specific payload path linux/darwin/win32, downloads a binary over HTTPS from...

Malicious code in claims-historical-claims-domain (npm)

Source: amazon-inspector 821551bfee1b6a8fa74b001808fad75327d22654f228600f02a6130edc31ce2e On require, index.js loads bridge.js which selects a platform-specific URL path and downloads a binary via https.get from hostnames assembled by string-splitting fragments such as 'oob-worker.cf-.workers.dev...

Malicious code in claims-policy-details-domain (npm)

Source: amazon-inspector ddd2a9e4dd34aac1232648e9e5f459331bd73d0f3779ed68ac559d8f4692c9bb On require of claims-policy-details-domain, index.js loads vendor.js which downloads a platform-specific binary from anonymous Cloudflare workers.dev subdomains oob-worker.cf100-416.workers.dev,...

Malicious code in claims-format-money (npm)

Source: amazon-inspector bc73b342ec9e00a543a54dcf8c212c8107638a9f2630ce32f239af5cc6a2d009 The package's index.js requires bootstrap.js on import. bootstrap.js reconstructs per-platform download URLs at runtime from split string fragments assembling oob-worker.cf-.workers.dev hosts with DNS TXT...

Malicious code in claims-get-error-string (npm)

Source: amazon-inspector 8107a092447bc749767928c38a816191c2af0ea06cb12d6dbeddb9f09b46c698 On require, index.js loads ext.js which downloads a platform-specific binary from a set of hardcoded Cloudflare Workers hosts oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev,...

Malicious code in claims-microgen-templates (npm)

Source: amazon-inspector 9d4eefb6f5d91cfe86acf925e0d84b5cb34336f98cf73586e01d17418d02454f On require of the package, index.js loads compat.js which fetches a platform-specific binary from string-concatenated Cloudflare Workers hosts oob-worker.cf1-01-adf.workers.dev,...

Malicious code in claims-person-api-adapters (npm)

Source: amazon-inspector ef5943c3dd39268851fabc25f5a2c686cf8b102954be63cb80afb04c03deddc6 On require of the package, index.js loads ext.js which reconstructs hardcoded network destinations via Array.join string-splitting to evade static analysis, resolving to four Cloudflare Workers hosts of the...

Malicious code in claims-page-maker-types (npm)

Source: amazon-inspector b337b617f3692fffb0d54a13924ae322ed7e2976c00a61f16c16877aa8c086e5 On require of claims-page-maker-types, index.js loads adapter.js which runs at module load. adapter.js selects a platform-specific asset, fetches an opaque binary over HTTPS from one of four hardcoded...

Malicious code in claims-navigate (npm)

Source: amazon-inspector 216f23cb2cf520b0a927a0e5aade04814996c6d4f058989120fd09632239dbb0 On require of the package, index.js loads adapter.js which downloads an opaque binary from author-controlled Cloudflare Workers subdomains oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev,...

Malicious code in claims-format-date (npm)

Source: amazon-inspector 776846029f9cb0fea6a6afd33178425861ef02c062754874b2a49ff078095efd [email protected] auto-executes a binary dropper when the module is required. index.js requires./init on load; init.js downloads a platform-specific binary from string-split-obfuscated Cloudflare...

Malicious code in claims-patch-url (npm)

Source: amazon-inspector c07292652ca72654d945a2833f8cf8915ea79f1ce665a0445938ff2605394c08 [email protected] presents an empty ClaimsPatchUrl shell class in index.js and unconditionally requires./compat.js on load. On require, compat.js selects a platform-specific endpoint, downloads an opaq...

Malicious code in claims-payout-offer-domain (npm)

Source: amazon-inspector b7e5ae73b4b2f79e2790e4c9f503a3f469166c8d5587f7e84ac6a09022d1617f On require of the package, index.js unconditionally loads vendor.js, which selects an OS/arch-specific payload path and fetches an opaque binary over HTTPS from string-obfuscated Cloudflare Workers hosts...

Malicious code in claims-person-domain (npm)

Source: amazon-inspector 03f8408e0f3ee2e4d802003cc54666a1e535bbd512e8515d1ef3b7a63acf16d8 On require of the package's main entry, index.js loads./support.js which selects a platform-specific asset path linux/darwin/win32, fetches an opaque binary from one of four Cloudflare Workers endpoints whos...