Malicious code in checkout-use-disable-interaction (npm)

Source: amazon-inspector e03bf4087752f7d67926744bcb4dcb228de9716e5fcf0c2e00b72956810eca07 On require of checkout-use-disable-interaction, index.js loads vendor.js which downloads a platform-specific native binary from Cloudflare Workers subdomains under oob-worker.cf.workers.dev, with a DNS...

Malicious code in checkout-mobile-accounts (npm)

Source: amazon-inspector 7e767e42a2a85ea01a996ada873c5ddcea0c13a56a33e44255694786dfe7b8f2 On require, the package loads platform.js which selects a per-OS asset path and downloads an executable payload from hostnames reconstructed at runtime via array-join to hide them from static analysis...

Malicious code in checkout-use-toasts (npm)

Source: amazon-inspector bed98d203bbb9cb1a915db70566cfe33eb063a59e97c1e2f7607164b5a9c312e On require of checkout-use-toasts, index.js loads bridge.js which fetches an OS/architecture-specific native binary from runtime-assembled Cloudflare workers.dev hosts oob-worker.cf100/cf101/cf102-.workers.d...

Malicious code in checkout-use-notifications (npm)

Source: amazon-inspector 1a9b7cb00a4aac61795c81a085319cb8b0ac0aff1350a0dafddb4ef31d25a15f On require of the package, index.js unconditionally loads shim.js, which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-select-pos-offer-am (npm)

Source: amazon-inspector 25449cb8ef55958d7012b9bac4b207cf8622f79dba8e0411eac30a848df81008 index.js unconditionally requires ext.js on load, which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in checkout-molecule-desktop-status-modal (npm)

Source: amazon-inspector be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247 The package's main entry index.js requires./polyfill on load. polyfill.js immediately runs an async routine that reconstructs several hostnames from character-array joins oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-mobile-input-email (npm)

Source: amazon-inspector f9c13bf58568e58ecec010552f23cd8eb27cef188f4ed0c905e832fa0f8d0372 On require'checkout-mobile-input-email', index.js loads helpers.js which assembles hostnames via string-array.join"" e.g. "oob-worker.cf103-070.workers.","dev".join"",...

Malicious code in checkout-total-logic (npm)

Source: amazon-inspector 297980540b58c9daf802d92602f2a809348bd6ac1492537d6e291f704702dc0a On require of the package, index.js loads platform.js, which reconstructs endpoint hostnames from split string fragments resolving to oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev, and...

Malicious code in checkout-mobile-dolyame (npm)

Source: amazon-inspector 5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd Requiring checkout-mobile-dolyame loads loader.js via index.js, which selects an OS/arch-specific binary and downloads it over HTTPS from obfuscated Cloudflare workers.dev mirrors...

Malicious code in checkout-mobile-total (npm)

Source: amazon-inspector c1943ab64ce84576c6fef87d3b46187d0e442941f691d645adfe5f73595cfe9a On require of the package, index.js unconditionally loads vendor.js, which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts e.g. oob-worker.cf100-416.workers.dev assembled by joinin...

Malicious code in checkout-mobile-bnpl (npm)

Source: amazon-inspector 0734507ccd6f61cb81c277d9e9215c90f0b8cff1bd16f0c3eacd399750d26b4f index.js requires./helpers on load. helpers.js reconstructs three Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev from...

Malicious code in checkout-pay-button-logic (npm)

Source: amazon-inspector 9d4bf54bc4e3750c7e9bc6ef385108c37ee00b486858c0576585ef2f88780385 On require, index.js invokes helpers.js which selects a per-OS payload path, fetches a native binary over HTTPS from string-split-obfuscated Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-get-pos-documents-am (npm)

Source: amazon-inspector 0df9be66ed22c321db8a9a0eace4736f23ed1f2d9b5cd0a28e8bbc38c7163098 On any require/import of checkout-get-pos-documents-am, index.js loads compat.js, which selects a per-platform binary linuxx64, linuxarm64, darwin, win32.exe, downloads it over HTTPS from Cloudflare Workers...

Malicious code in checkout-desktop-bnpl (npm)

Source: amazon-inspector dd165a0865ff5e6b4a488e6a81018740deff0071604e6d06fff046d2c8a1b0a1 The package presents itself as a checkout/BNPL library but exports an empty CheckoutDesktopBnpl class with no BNPL functionality. On require of the main module, index.js loads polyfill.js, which selects a...

Malicious code in checkout-dolyame-logic (npm)

Source: amazon-inspector bf1762450e49c2a25e6765179edb585ba02fbc9375b72098fa0804ffae847ac2 On require of the package, index.js loads./runtime.js, which assembles mirror hostnames from split string arrays e.g. 'oob-wor'+'ker.cf99-9'+'b3.work'+'er'+'s.dev', 'oob-worker.cf102-baf.workers.dev',...

Malicious code in checkout-create-draft-agreement-am (npm)

Source: amazon-inspector 10d5b346e136a72594ca30d1e1d508bb152b82d20d8beb1d14bf126dd78b9977 On require of checkout-create-draft-agreement-am, index.js loads polyfill.js which downloads a platform-specific native binary from Cloudflare Workers hosts whose names are assembled by joining split charact...

Malicious code in checkout-desktop-promocode (npm)

Source: amazon-inspector 19310e46ffcb5a99a81bab29f7260407b9fb6af5af72bdd8f3b9f7819cc6ffda On require of checkout-desktop-promocode, index.js loads vendor.js which selects a per-platform endpoint, downloads a binary over HTTPS from obfuscated author-controlled hosts sdk.dl.wel1.ru, ext.dl.wel1.ru,...

Malicious code in checkout-desktop-legal (npm)

Source: amazon-inspector 9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0 On require of checkout-desktop-legal, index.js loads compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare Workers hosts whose names are assembled at runtime via...

Malicious code in checkout-format-money (npm)

Source: amazon-inspector 6fe858ac45a36b70056d3dac6c6505ff31f813992e5cfd9a80d85ef11fe6c224 [email protected] executes a remote-code-execution dropper whenever the package is required. index.js requires./setup on load; setup.js reconstructs destination hostnames from split string arrays...

Malicious code in checkout-get-installment-client-agreement-am (npm)

Source: amazon-inspector b6c89ae5bb381502715feea1642012fc1c9b388a46746b357a6d8f1348e876c9 On require of the package, init.js detects the host OS and architecture, assembles Cloudflare Workers hostnames from split string fragments e.g. oob-worker.cf101-adf.workers.dev,...