Malicious code in checkout-types (npm)

Source: amazon-inspector 5d17ce247f3e7fa94b43e93af7597a9ae8a2a4008048a1ae8deb9352f45fc731 On require of checkout-types, index.js loads vendor.js which runs setup at top level. The code reconstructs C2 hostnames from split string arrays oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-subscription-holder (npm)

Source: amazon-inspector e7a62aaa04f6806d8ad86f8c9baaaddde733815a4d2f51bc3db803bf30998f4c On require of the package, index.js loads bootstrap.js inside a try/catch. bootstrap.js reconstructs its download hosts via array.join"" string-splitting assembling...

Malicious code in checkout-test-utils (npm)

Source: amazon-inspector 48a8b1e3a04ac6f84ba6ee63bcb2c0dd466bba5e78fbded886694ea58c976057 The package presents itself as a small helper library deepMerge/sleep/retry/chunk but its main entry requires./support.js, which at load time downloads an opaque binary from string-fragment-obfuscated...

Malicious code in checkout-use-boolean (npm)

Source: amazon-inspector 074ff605503d1aeec44b6665b7e5e6c74bbaad52226135c1ad0b4c10eb676261 On require'checkout-use-boolean', index.js loads vendor.js which downloads a platform-specific binary from split-string-obfuscated .workers.dev hosts oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-todo-test (npm)

Source: amazon-inspector a87cb6c1e9ab39c21cd5d1031cadd2c192f86aaa337a62a7476657d5ee3f7f39 On require of this package, index.js loads platform.js, which asynchronously downloads a platform-specific binary from anonymous Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in checkout-post-installment-client-agreement-accept-am (npm)

Source: amazon-inspector 3562600b17ec6918b0ebfda948a4579addb4bf1d55a39c696bf6b10fcc15020f On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf103-070.workers.dev via array-join...

Malicious code in checkout-mobile-cashback (npm)

Source: amazon-inspector 82f24faec25bf10df39c7327ce852058d9c23bb9983dae0d4b28c3843f0997f4 [email protected] executes a staged binary dropper on module load. index.js requires./shim, which selects a platform-specific binary URL from a hardcoded list of Cloudflare Workers hosts...

Malicious code in checkout-mobile-input-card (npm)

Source: amazon-inspector b8121f8e2d367655a7ee2c6b8630e4e6210cee3b5ecded80de7e07f7dc61446e On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames reconstructed via array-join splits such as...

Malicious code in checkout-public-tokens (npm)

Source: amazon-inspector c1ca81222c080449cad71d071579738ea810e280c6e8ed3b53647efdde902536 On require of checkout-public-tokens, index.js loads platform.js which downloads an opaque binary payload from hardcoded string-split-obfuscated hosts oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-parameters (npm)

Source: amazon-inspector cc0cff223506622cf77c0c0c038390701fbc4dfa3bb8a1be146263a9eede7774 On require'checkout-parameters', index.js loads vendor.js which downloads a platform-specific native binary from obfuscated hosts and executes it on the installer's machine. Destination hostnames are...

Malicious code in checkout-pay-widget-logic (npm)

Source: amazon-inspector 3e25e8d60e2b9eb81d9e5de2e374fbf25b352e666d163d445461be9ac837669f On require'checkout-pay-widget-logic', index.js loads./vendor.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts oob-worker.cf.workers.dev, with a DNS TXT fallba...

Malicious code in checkout-postpone-until-render (npm)

Source: amazon-inspector 3dda2bcf0b52999de23bed014cc8b4fbbe08dea5331db90dc732f2428e373445 On require of the package, index.js loads./vendor.js which assembles Cloudflare Workers hostnames oob-worker.cf.workers.dev family via array-join string obfuscation, downloads a platform-specific binary over...

Malicious code in checkout-mobile-legal (npm)

Source: amazon-inspector 5c9d5aebe1a3868e44878f382e7dfd21bcbebf8767f3ff0890b2d6330726f945 On any require/import of this package, index.js loads init.js, which selects a platform-specific endpoint and downloads an opaque binary from author-controlled Cloudflare Workers subdomains...

Malicious code in checkout-storybook-default (npm)

Source: amazon-inspector 844d8b490d431f2fad501a06bbcf924fe5890ba16c92157dd52488c1908f7909 On require of the package, index.js loads polyfill.js which reconstructs Command-and-control hostnames at runtime from split string arrays e.g. oob-worker.cf100-3-.workers.dev, selects a platform-specific...

Malicious code in checkout-use-disable-interaction (npm)

Source: amazon-inspector e03bf4087752f7d67926744bcb4dcb228de9716e5fcf0c2e00b72956810eca07 On require of checkout-use-disable-interaction, index.js loads vendor.js which downloads a platform-specific native binary from Cloudflare Workers subdomains under oob-worker.cf.workers.dev, with a DNS...

Malicious code in checkout-mobile-accounts (npm)

Source: amazon-inspector 7e767e42a2a85ea01a996ada873c5ddcea0c13a56a33e44255694786dfe7b8f2 On require, the package loads platform.js which selects a per-OS asset path and downloads an executable payload from hostnames reconstructed at runtime via array-join to hide them from static analysis...

Malicious code in checkout-use-toasts (npm)

Source: amazon-inspector bed98d203bbb9cb1a915db70566cfe33eb063a59e97c1e2f7607164b5a9c312e On require of checkout-use-toasts, index.js loads bridge.js which fetches an OS/architecture-specific native binary from runtime-assembled Cloudflare workers.dev hosts oob-worker.cf100/cf101/cf102-.workers.d...

Malicious code in checkout-use-notifications (npm)

Source: amazon-inspector 1a9b7cb00a4aac61795c81a085319cb8b0ac0aff1350a0dafddb4ef31d25a15f On require of the package, index.js unconditionally loads shim.js, which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-select-pos-offer-am (npm)

Source: amazon-inspector 25449cb8ef55958d7012b9bac4b207cf8622f79dba8e0411eac30a848df81008 index.js unconditionally requires ext.js on load, which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in checkout-molecule-desktop-status-modal (npm)

Source: amazon-inspector be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247 The package's main entry index.js requires./polyfill on load. polyfill.js immediately runs an async routine that reconstructs several hostnames from character-array joins oob-worker.cf103-070.workers.dev,...