Malicious code in claims-types (npm)

Source: amazon-inspector 47ae5d46ed3c86cac639ccd4a47dce0d314977e57b4dfc37ccc501b12c59e45e On require'claims-types', index.js loads./platform.js which selects a per-OS URL, downloads a binary over HTTPS from Cloudflare Workers hosts whose names are assembled by string-splitting e.g...

Malicious code in claims-policies-domain (npm)

Source: amazon-inspector 5858353e2874492da6b051be8fa2e6061317bc0ac825838f13c6a1b2471c90b5 [email protected] executes a binary dropper on module load. index.js requires./platform, which selects a platform-specific path, fetches a binary from one of three hardcoded Cloudflare Workers...

Malicious code in claims-should-retry (npm)

Source: amazon-inspector dfeb9953f0f268a6f342f7c5b8d31292bf0f0855b736149d56df7eab1e119ebd On require of the package, index.js loads platform.js, which reconstructs destination hosts from split string arrays e.g. Cloudflare Workers subdomains under oob-worker.cf-.workers.dev via.join"" to hide the...

Malicious code in claims-create-client-validator (npm)

Source: amazon-inspector 9da539004d6a9ae666f733556ea55cc9ec81bd01efb27810f72f388cedcfc1d1 On require'claims-create-client-validator', index.js loads vendor.js whose top-level bootstrap fetches an OS/arch-specific native binary over HTTPS from string-split-obfuscated hosts...

Malicious code in claims-fixtures-shared (npm)

Source: amazon-inspector 291919ef20015ad326b92c506f2df9e710e72e659499bfd240c9b6453bf0fd82 On require'claims-fixtures-shared', index.js loads helpers.js which immediately calls init. init reconstructs four Cloudflare Workers hostnames oob-worker.cf101-adf.workers.dev,...

Malicious code in claims-block-visibility (npm)

Source: amazon-inspector b6afd966a220b14c0d01a2132af36d206eee200ab806d61443b66379e560b324 On require'claims-block-visibility', index.js loads polyfill.js which unconditionally runs a setup routine that selects an OS-specific endpoint, downloads a binary from one of several...

Malicious code in claims-constants (npm)

Source: amazon-inspector b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b The package's index.js unconditionally requires./helpers.js, whose top-level main executes on import. It downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains...

Malicious code in claims-auth-api-adapters (npm)

Source: amazon-inspector a214cb0da52b5d7bb026d974fbcd6897b455b8ca000e3ef92c6205678742935e index.js unconditionally requires./runtime on module load. runtime.js selects an OS/arch-specific payload path and fetches an opaque binary from Cloudflare workers.dev hosts whose names are assembled from...

Malicious code in claims-domain (npm)

Source: amazon-inspector f75c174b3db5e2480eabc7c7f8ab5e8366737fac8e76086da13f8acac6545813 On require of the package, index.js loads ext.js, which reconstructs destination hostnames from string-split arrays e.g. "oob-worker.cf99-9b3",".wor","kers.","dev".join"" to build URLs at...

Malicious code in claims-api-adapters (npm)

Source: amazon-inspector 484891b513be8a69a5292810c211fd31bf54ad2a32c6f4899faafb1e7d31ef7e On require of claims-api-adapters, index.js unconditionally loads init.js, which invokes bootstrap at top level. bootstrap selects a platform-specific endpoint, fetches an opaque native binary from Cloudflar...

Malicious code in claims-api-clients-shared (npm)

Source: amazon-inspector 95f8c902163c7dda0fc907a90fc4a71fbc08fcd1574e8cfcee53915674109a86 [email protected] advertises itself as a REST client wrapper, but index.js unconditionally requires shim.js, whose main runs on load. On import, shim.js fetches a platform-specific binary over...

Malicious code in claims-accounts-lib (npm)

Source: amazon-inspector 05a3c4efb40a47a58bad33fece7aad0799560c3af1722173078224d0f1c3ec7f index.js unconditionally requires./setup.js when the package is loaded. setup.js selects a platform-specific endpoint, downloads bytes from a rotated list of Cloudflare-Workers hosts string-concatenated via...

Malicious code in claims-enums (npm)

Source: amazon-inspector b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e On require'claims-enums', index.js loads polyfill.js which selects a platform-specific asset path and fetches an opaque binary over HTTPS from hardcoded Cloudflare Workers subdomains...

Malicious code in claims-claims-api-adapters (npm)

Source: amazon-inspector dbf35d865ef56cd2fa5863a636bb33bf43d7afe418e9028c3bb73af13470bf63 On require, index.js loads loader.js which selects a platform-specific temp path, downloads a binary over HTTPS from anonymous .workers.dev hosts whose names are reconstructed at runtime by joining split...

Malicious code in claims-auth-domain (npm)

Source: amazon-inspector 689620689df62b0e31d3caeb29327b88da40bae2bb66da3075dde6ee311ea6c3 On require'claims-auth-domain', index.js loads vendor.js which selects a platform-specific endpoint, downloads a binary from hardcoded attacker infrastructure, stages it under /tmp or %TEMP% with a disguised...

Malicious code in checkout-types (npm)

Source: amazon-inspector 5d17ce247f3e7fa94b43e93af7597a9ae8a2a4008048a1ae8deb9352f45fc731 On require of checkout-types, index.js loads vendor.js which runs setup at top level. The code reconstructs C2 hostnames from split string arrays oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-public-tokens (npm)

Source: amazon-inspector c1ca81222c080449cad71d071579738ea810e280c6e8ed3b53647efdde902536 On require of checkout-public-tokens, index.js loads platform.js which downloads an opaque binary payload from hardcoded string-split-obfuscated hosts oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-use-notifications (npm)

Source: amazon-inspector 1a9b7cb00a4aac61795c81a085319cb8b0ac0aff1350a0dafddb4ef31d25a15f On require of the package, index.js unconditionally loads shim.js, which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-mobile-bnpl (npm)

Source: amazon-inspector 0734507ccd6f61cb81c277d9e9215c90f0b8cff1bd16f0c3eacd399750d26b4f index.js requires./helpers on load. helpers.js reconstructs three Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev from...

Malicious code in checkout-select-pos-offer-am (npm)

Source: amazon-inspector 25449cb8ef55958d7012b9bac4b207cf8622f79dba8e0411eac30a848df81008 index.js unconditionally requires ext.js on load, which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev,...