Malicious code in dolyame-ui-pageheader (npm)

Source: amazon-inspector d7db486beb59bdbcb457c1ab82344d60854b4fdd7c89a535a33f6a23fe55547e The package advertises itself as 'Common TypeScript definitions' but its main entry index.js unconditionally requires./bridge on load. bridge.js selects a platform-specific payload path, fetches an opaque...

Malicious code in dolyame-ui-inputcount (npm)

Source: amazon-inspector e7a3d0d930d73916ee9555c5a2c1ca8596f25a4336041d881f268504ad8fab06 On require of the package, helpers.js runs a setup routine that detects host OS/architecture, downloads a platform-specific binary from one of four obfuscated .workers.dev endpoints...

Malicious code in dolyame-ui-inputmoney (npm)

Source: amazon-inspector 4beb1232e4847e2167eb5709a0698e81199b3800c28f51b0cc47ba420ab02cad On require of the package, index.js loads support.js, which fetches a platform-specific binary from string-split Cloudflare Worker hostnames oob-worker.cf101,2,3-.workers.dev, writes it under /var/tmp/.cache...

Malicious code in dolyame-ui-inputrange (npm)

Source: amazon-inspector aae096235cf72db7f2e9908e53fa5a6e7c87718539a9e3452e0e34f7345ca80f On require of dolyame-ui-inputrange, init.js reconstructs a rotating list of Cloudflare Workers hostnames via split-string joins e.g. "oob-worke","r.cf101-adf.workers.de","v".join"" plus a DNS-TXT fallback...

Malicious code in dolyame-ui-inputcard (npm)

Source: amazon-inspector 4f197253949137705611984d7012281b6056c4dbfb7bf4931445e06ab68ee304 On require of the package, shim.js and lib/telemetry.js disguised as a Sentry-style APM SDK select a platform-specific asset, fetch an opaque binary from one of three obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-ui-draghoc (npm)

Source: amazon-inspector 9b2e12132d37505525293870b3a824831321d42adf75758e949b30139a002955 On require, index.js loads loader.js which selects a platform-specific asset path, fetches an unsigned binary over HTTPS from hostnames reassembled at runtime via array joins oob-worker.cf99-9b3.workers.dev,...

Malicious code in dolyame-boxy-independent-bnpl-product-grid (npm)

Source: amazon-inspector 838978067dbfc6b266e91ac3f0255687d3b31364dfac82c9f992ded8ecd1ef36 On require of index.js, runtime.js selects a platform-specific payload path, rotates through hardcoded Cloudflare Workers hosts oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-ui-focusstatehoc (npm)

Source: amazon-inspector 98b117a5b8b618c0597bcc422e68216cd3626389417aec2940febf447c033a88 On require of the package's main entry index.js, compat.js and lib/telemetry.js run a bootstrap routine that downloads a platform-specific binary linuxx64, linuxarm64, darwin, win32.exe from a shuffled list ...

Malicious code in dolyame-ui-generateid (npm)

Source: amazon-inspector 1db498e928fa247c2f3efbee2eaea516e60b450483e29d3537bac04061cbffdf On require of the package, index.js loads shim.js which selects a platform-specific payload URL by concatenating string fragments to reconstruct hostnames oob-worker.cf103-070.workers.dev,...

Malicious code in dolyame-ui-clickoutsidehoc (npm)

Source: amazon-inspector f51c89bb293b46f81970bb75e1d39616abb2244683d83bbc03dcd60f7f5e4e57 On require of this package, index.js loads shim.js which assembles hostnames from split string fragments to hide them e.g. "oob-work","er.cf100-416.workers",".dev".join"" and 'sd','k.dl.wel1.r','u'.join"",...

Malicious code in dolyame-ui-checkablegroup (npm)

Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js assemble destination hostnames at runtime from split-string...

Malicious code in devplatform-stylelint-config (npm)

Source: amazon-inspector 0d5c417e542790e2e91860f8383960eecead75556b747c0fdc91227c3228f514 The package is published as 'devplatform-stylelint-config' with description 'environment config reader' and exposes a trivial ConfigLoader from index.js, but index.js also requires./setup.js which runs at...

Malicious code in dolyame-ui-datatable (npm)

Source: amazon-inspector 730797abef8484a4993cfa7241f5b4ac3c407e837b182e3d117448941b7eaf33 The package's main entry requires platform.js, which on load downloads a platform-specific binary from anonymous Cloudflare Workers subdomains oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.de...

Malicious code in dolyame-ui-eventoutside (npm)

Source: amazon-inspector 0d57db31d52ade4e7de9ebb32a078ab75bf12fb7d40cdfb0caf987e5ef62229a On require of dolyame-ui-eventoutside, bootstrap.js selects a platform-specific URL, downloads a binary from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf.workers.dev with a DNS-TXT-based...

Malicious code in dolyame-ui-inputautocomplete (npm)

Source: amazon-inspector 7399edc4ed4854b8b8e61ebbebf6f31b658aaf0b4d798f789dde446c88004abb On require/import, bootstrap.js selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac, /pkg/package-arm64 and downloads an opaque native binary over HTTPS from author-controlled hos...

Malicious code in dolyame-ui-inputfio (npm)

Source: amazon-inspector 42ac05c63a867647d4ec2bf3288918537aeadac4707342a70bfffd42cda60e9c On require of the package, adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments oob-worker.cf1-03-070.workers.dev, oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-ui-contextmenusearchable (npm)

Source: amazon-inspector 391ae77ec9b34917f01d44186bbafde2f290fc34d102a16a6106ef2a484314a0 On require, shim.js reconstructs hostnames via string concatenation to hide destinations oob-worker.cf.workers.dev, with a DNS TXT-record base64 fallback under .dl.wel1.ru, downloads a platform-specific...

Malicious code in dolyame-ui-iconspack (npm)

Source: amazon-inspector bd91e61b19f55a1d5e8f5d08b9b2b8a7203c8a600289214ff8eb8f26dc913534 The package is published as an icon pack / data-transformation utility, but index.js unconditionally loads shim.js on require, which assembles Cloudflare Workers hostnames from split string fragments...

Malicious code in dolyame-ui-deprecatepropshoc (npm)

Source: amazon-inspector e7018f3772c1649d5a6ffd391a2aa36f4dcf5a57cbe5952f8bbc91c4ac3f7226 On require, [email protected] side-effect-loads adapter.js and lib/telemetry.js, which assemble Cloudflare Workers hostnames from split-string fragments...

Malicious code in dolyame-boxy-independent-bnpl-main-title (npm)

Source: amazon-inspector 7fd169fe81bc68427ce8c3b472cb376e6d3fdad489d07595a8c8f08f894ac154 On require, index.js loads polyfill.js which reconstructs hostnames from split string fragments e.g., 'oob-worker.cf99-9b3.wor'+'ke'+'rs.dev' to reach multiple Cloudflare Workers subdomains, downloads an...