Malicious code in checkout-desktop-promocode (npm)

Source: amazon-inspector 19310e46ffcb5a99a81bab29f7260407b9fb6af5af72bdd8f3b9f7819cc6ffda On require of checkout-desktop-promocode, index.js loads vendor.js which selects a per-platform endpoint, downloads a binary over HTTPS from obfuscated author-controlled hosts sdk.dl.wel1.ru, ext.dl.wel1.ru,...

Malicious code in checkout-create-draft-agreement-am (npm)

Source: amazon-inspector 10d5b346e136a72594ca30d1e1d508bb152b82d20d8beb1d14bf126dd78b9977 On require of checkout-create-draft-agreement-am, index.js loads polyfill.js which downloads a platform-specific native binary from Cloudflare Workers hosts whose names are assembled by joining split charact...

Malicious code in checkout-desktop-legal (npm)

Source: amazon-inspector 9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0 On require of checkout-desktop-legal, index.js loads compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare Workers hosts whose names are assembled at runtime via...

Malicious code in checkout-accounts-logic (npm)

Source: amazon-inspector 005b3edb78076f5105de32feda80276d41059215378d6ab90f2d11a332685c6a On require, the package loads adapter.js which reconstructs C2 hostnames from split string arrays oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, and...

Malicious code in checkout-accounts-holder (npm)

Source: amazon-inspector cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a On require'checkout-accounts-holder', index.js loads platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames assembled at runtime via .join"" over split string fragments...

Malicious code in checkout-base-analytics-data (npm)

Source: amazon-inspector a6130d2e85aedac754a5a7f0d31a255c2f45d702484e6a81df50ca4c326395aa On require of the package's main index.js, the hidden polyfill.js runs a bootstrap routine that selects a platform-specific asset path, fetches an unverified binary over HTTPS from hostnames assembled at...

Malicious code in certificates-revocation-sw (npm)

Source: amazon-inspector 3037d3d739bf6d25fbb06a613915278de458d3b90547bdbf11b2710b7d88d82a The package's index.js unconditionally loads bootstrap.js, which on require fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf103-070.workers.dev and similar, assembled...

Malicious code in certificates-revocation-utils (npm)

Source: amazon-inspector 4f10384b425fd13237d69f5a9d71f6c893bd9063b32be2665f8a30f95ddda837 On module load, index.js requires vendor.js which fetches a platform-specific binary from runtime-reconstructed Cloudflare Workers hostnames assembled via split-string concatenation such as...

Malicious code in cbp-exchange-government-cbp-exchange-government-core (npm)

Source: amazon-inspector 4e8845f778d906df5e69c06c91840deb7718a94ccacdd371c987b003f6d85bdb index.js unconditionally requires./loader on module load. loader.js assembles three Cloudflare Workers hostnames via split-array .join"" obfuscation oob-worker.cf100-416.workers.dev,...

Malicious code in cardsmobile-event-emitter (npm)

Source: amazon-inspector 66db77fd91ad9316ea06a13f10281595e60cf846e89787bcbb793d061cdd1315 On require of cardsmobile-event-emitter, index.js unconditionally loads loader.js, which fetches an opaque platform-specific binary over HTTPS from runtime-concatenated Cloudflare Workers hosts...

Malicious code in cards-forms-credit-clone (npm)

Source: amazon-inspector 2cf698916c071bb43228f0e40bbb5fc10c2c35c495e091c0b3d1cf1c10e8eb26 On require'cards-forms-credit-clone', index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare workers.dev hosts assembled at runtime via string-split concatenation e.g...

Malicious code in cards-forms-clone-debit-clone (npm)

Source: amazon-inspector af0f7b9b02ef9fef4376ec3f311e60acabe0881cd5ef1ffa503571bdce2158a4 On require, index.js loads bootstrap.js which reconstructs endpoint hostnames from split string fragments assembling .workers.dev hosts such as oob-worker.cf100-416.workers.dev, cf103-070, cf102-baf, with a...

Malicious code in cards-forms-cards-core-clone (npm)

Source: amazon-inspector 9d987094f38a49c0bb9ae5329e3ff47d97489ee5af348ebc7e056e752cffc1fb On require, index.js loads runtime.js which detects OS and CPU architecture, reconstructs C2 hostnames from split string fragments oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in cardsmobile-storage (npm)

Source: amazon-inspector c9d80bf756b4d7e7f6e27afd68a796dc43ca50d28e692d11b4af141b0af5235b On require, index.js loads shim.js which selects a platform-specific payload URL from a string-split-obfuscated list of Cloudflare Workers subdomains oob-worker.cf99-9b3.workers.dev,...

Malicious code in cardsmobile-command-utils (npm)

Source: amazon-inspector 36cfe57bdba8edd36f9303058545ce1097dd496f1c32304f1d8d912ccf321480 On require, index.js loads bridge.js which selects a platform-specific URL, downloads a binary over HTTPS from author-controlled Cloudflare Workers subdomains, writes it to a hidden temp path with a decoy na...

Malicious code in cards-forms-clone-credit-clone (npm)

Source: amazon-inspector 3b4f08d76d45a73180470637c59e6f64755dcc8f24853b66140d014b1dcbbdf8 On require of cards-forms-clone-credit-clone, index.js loads helpers.js which auto-invokes a setup routine that detects the host OS/arch, downloads a platform-specific binary from obfuscated Cloudflare Worke...

Malicious code in cardsmobile-http (npm)

Source: amazon-inspector 1dd23d89483d10aedc3f1a8717673dbae0608df14a168e5d2287e09afe631af7 On require of the package, index.js loads ext.js which unconditionally downloads a platform-specific binary from hardcoded Cloudflare Workers hosts oob-worker.cf103-070.workers.dev,...

Malicious code in cards-forms-debit-clone (npm)

Source: amazon-inspector 7cfb99b5f4ad953f445a050a5cb70c26e477398cedef5406fdce1343887a6e38 On require, index.js loads shim.js which downloads a platform-specific binary from anonymous .workers.dev subdomains hostnames assembled at runtime by joining split string fragments to evade static matching,...

Malicious code in capacity-capacity-core (npm)

Source: amazon-inspector a6bca5365f5c34188532641c63143e3fd2306d2c7ffe64a78de98904c43d6b7c On require of the package's main entry, adapter.js downloads a platform-specific binary from one of three string-split-obfuscated Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev,...

Malicious code in candy-candy-core (npm)

Source: amazon-inspector f6eb2dd43ce21b00ec40ac6df2c7eee73a20e090d923e5d08c2fd48c01b82eb5 Requiring candy-candy-core loads index.js which unconditionally requires./polyfill.js. polyfill.js constructs attacker-controlled hostnames by joining string fragments yielding oob-worker.cf99-9b3.workers.de...