Malicious code in sme-rko-finance-front-payments-feed-display-list (npm)

Source: amazon-inspector eedf1850bd0f58b8adef8a6b6c3ac13adf7848819306e5a7b9518cbb174911a3 On require of the package's main module, compat.js unconditionally downloads a platform-specific executable and runs it. Destination hosts are assembled at runtime from split string arrays e.g...

Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)

Source: amazon-inspector 6d957fec8c08e1dcadbcd6e4b6933a1c1482356e79adbfe1f6ceb6d64a68855f On require of the package, bootstrap.js selects a platform-specific path from a hardcoded map, downloads an opaque binary from one of three Cloudflare Workers hosts whose names are reassembled at runtime fro...

Malicious code in sme-rko-finance-front-payments-feed-display-list-impl (npm)

Source: amazon-inspector 4e33cae8840b73256d5d48935bfa7b8490ea7a36d56edeff8adfc4ca19dfea49 On require, index.js loads helpers.js which selects a platform-specific endpoint, downloads a binary from one of three string-concatenation-obfuscated Cloudflare Workers hosts oob-worker.cf101-adf.workers.de...

Malicious code in sme-rko-finance-front-payments-feed-adapter (npm)

Source: amazon-inspector 05877cb287448f82b3b8a223454971cbd881ff8667e597472c04123697295220 The package is advertised as a finance/payments adapter but on require reaches a staged loader. adapter.js reconstructs destination hostnames from split array literals e.g.,...

Malicious code in sme-rko-finance-front-operations-widget-models (npm)

Source: amazon-inspector b9ade51039ea665ab18df8b84fe421e04802f8f5830983e37064b937cb14509a On require of the package, platform.js and lib/telemetry.js run a bootstrap that selects a platform-specific asset, fetches an opaque binary from one of three anonymous Cloudflare Workers hosts...

Malicious code in sme-rko-finance-front-payment-registers-operations-domain (npm)

Source: amazon-inspector 5b21f700cd5e3a5eb33a34fa9e3a9754e73e5794ee1cc57ada01344004a8c921 index.js unconditionally loads runtime.js on require. runtime.js detects the host OS and architecture, then downloads an opaque platform-matched binary over HTTPS from hardcoded Cloudflare workers.dev...

Malicious code in sme-rko-finance-front-operations-widget-impl (npm)

Source: amazon-inspector f1cadf7bdbe8322e1878572d42f769a267d9a2af7a61c0da00f02c1436799824 index.js requires./setup on load, which selects a platform-specific binary path linux/darwin/win32 and fetches an opaque native executable from one of several Cloudflare Workers hosts...

Malicious code in sme-rko-finance-front-operations-widget-domain (npm)

Source: amazon-inspector 13823f2899a1bfed6b46575763e7ee2629fa4d9388130713a88125b1f38d6dae On require of this package, index.js loads compat.js, which downloads a platform-specific native binary from Cloudflare Workers subdomains under oob-worker.cf.workers.dev and, on failure, reassembles the...

Malicious code in sme-rko-finance-front-operations-tax (npm)

Source: amazon-inspector ede42a446ab3685943424af5a5411fb93bf5961c83ccf6ce02b35b8d835c60aa On require, index.js loads platform.js and lib/telemetry.js, which download a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev, cf103-070, cf102-baf with a D...

Malicious code in sme-rko-finance-front-operations-overnight (npm)

Source: amazon-inspector bcd5c58bd9b678ac91c87dbb7f9a1d2318c67cd3754d643550c7674c903186de On require, this package loads ext.js and lib/telemetry.js which fetch a platform-specific opaque binary from a rotating list of attacker-controlled Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in sme-rko-finance-front-operations-providers (npm)

Source: amazon-inspector 85709f3e95d677177f1e55976d46cf4e16582e9cf3c1b310a7e67dd09885a743 On require of the package, index.js loads bridge.js which assembles Cloudflare Workers subdomain hostnames from split string fragments oob-worker.cf103-070.workers.dev, cf100-416, cf101-adf.workers.dev and...

Malicious code in sme-rko-finance-front-operations-penalty (npm)

Source: amazon-inspector 6b92a10d396bb1914ec6de4aff1dbd6845b09bcc1087fa8b1c49cf455d33d887 On require of the package, runtime.js and lib/telemetry.js reassemble Cloudflare Workers hostnames oob-worker.cf103-07/cf99-9b3/cf100-416/cf101-adf.workers.dev from split string arrays, fetch a...

Malicious code in sme-rko-finance-front-operations-other (npm)

Source: amazon-inspector c11dc6f375e9ceaee8f1b8e40db07f49c88e7bc47715759b101d3513399047be On require/import, init.js selects an OS/arch-specific binary and downloads it from a rotating set of Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev,...

Malicious code in sme-rko-finance-front-operations-fee (npm)

Source: amazon-inspector 6a2ef64871ebe6bf7dd675b3e686beec5a90dbaec72760b647e3c876674df9c5 The package's main entry ./lib/telemetry and its vendor.js module execute a binary dropper at require/import time. Hostnames and API identifiers are reconstructed from split-string arrays to evade static...

Malicious code in @rbx-ts/services (npm)

Source: amazon-inspector 22a1774c78b52b3d507d305227a1a258795a4e68d52b8366e0010c5d0bb80126 scripts/postinstall.js is obfuscated with hex-escaped identifiers and base64-encoded strings that hide standard API names 'https', 'fs', 'childprocess', 'powershell', '.exe' and a download URL. On npm instal...

Malicious code in sme-rko-finance-front-operations-notifications-models (npm)

Source: amazon-inspector e1d9ca70f719a1aa76a11ce147945ee7acefdb72bcbf955d1c7cd30a5d9f85e8 On require of the package, index.js side-effect loads polyfill.js and lib/telemetry.js, both of which act as native-binary droppers. Hostnames and privileged API names are assembled via array.join'' to evade...

Malicious code in sme-rko-finance-front-operations-holding-domain (npm)

Source: amazon-inspector f6838cce82eaa89f91af46e82f5153f7318dafd0ebccb4bdbb6251114d95ff51 On require of the package, shim.js executes a bootstrap at module top level that fetches a platform-specific native binary from string-concatenation-obfuscated hosts under oob-worker.cf100,1,2-.workers.dev,...

Malicious code in sme-rko-finance-front-operations-income (npm)

Source: amazon-inspector 7448e3b039f1a22821f5906a1b39378c1259cb5d98090c1b1b8176421482ec0a On require of the package, compat.js reconstructs attacker-controlled hostnames via array split-and-join obfuscation oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev,...

Malicious code in map-streak-kit (npm)

Source: amazon-inspector 80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4 On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x8664 binary dist/internal/calc-math.dat as a detached background process. The binary is a RedShell-style remote-access implant: it beacons ...

Malicious code in sme-rko-finance-front-operations-feed-impl (npm)

Source: amazon-inspector dee413dd5d9f35d90594093501e52606a50dba9fcc61e73a7de489444b420229 On require, adapter.js and lib/telemetry.js assemble Cloudflare Workers hostnames from string-split arrays oob-worker.cf101-adf.workers.dev, cf99-9b3.workers.dev, cf103-070.workers.dev, cf100-416.workers.dev...