Malicious code in dolyame-ui-eventoutside (npm)

Source: amazon-inspector 0d57db31d52ade4e7de9ebb32a078ab75bf12fb7d40cdfb0caf987e5ef62229a On require of dolyame-ui-eventoutside, bootstrap.js selects a platform-specific URL, downloads a binary from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf.workers.dev with a DNS-TXT-based...

Malicious code in dolyame-ui-inputautocomplete (npm)

Source: amazon-inspector 7399edc4ed4854b8b8e61ebbebf6f31b658aaf0b4d798f789dde446c88004abb On require/import, bootstrap.js selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac, /pkg/package-arm64 and downloads an opaque native binary over HTTPS from author-controlled hos...

Malicious code in dolyame-ui-inputfio (npm)

Source: amazon-inspector 42ac05c63a867647d4ec2bf3288918537aeadac4707342a70bfffd42cda60e9c On require of the package, adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments oob-worker.cf1-03-070.workers.dev, oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-ui-contextmenusearchable (npm)

Source: amazon-inspector 391ae77ec9b34917f01d44186bbafde2f290fc34d102a16a6106ef2a484314a0 On require, shim.js reconstructs hostnames via string concatenation to hide destinations oob-worker.cf.workers.dev, with a DNS TXT-record base64 fallback under .dl.wel1.ru, downloads a platform-specific...

Malicious code in dolyame-ui-iconspack (npm)

Source: amazon-inspector bd91e61b19f55a1d5e8f5d08b9b2b8a7203c8a600289214ff8eb8f26dc913534 The package is published as an icon pack / data-transformation utility, but index.js unconditionally loads shim.js on require, which assembles Cloudflare Workers hostnames from split string fragments...

Malicious code in dolyame-boxy-independent-bnpl-main-title (npm)

Source: amazon-inspector 7fd169fe81bc68427ce8c3b472cb376e6d3fdad489d07595a8c8f08f894ac154 On require, index.js loads polyfill.js which reconstructs hostnames from split string fragments e.g., 'oob-worker.cf99-9b3.wor'+'ke'+'rs.dev' to reach multiple Cloudflare Workers subdomains, downloads an...

Malicious code in dolyame-ui-flatcorners (npm)

Source: amazon-inspector 9ae65f4eadd80905a644647c6f15aee082d428bf5812632a29015eccc924bf1b On require/import of the package, both adapter.js and the advertised main module lib/telemetry.js download an OS-specific binary from obfuscated third-party endpoints Cloudflare Workers subdomains...

Malicious code in dolyame-ui-carouselline (npm)

Source: amazon-inspector f7712f1618991466bc33076081db37dd883be10f4c0c4308fe66216cece89a03 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct destination hostnames from string arrays e.g. oob-worker.cf99-9b3.workers.dev,...

Malicious code in dolyame-ui-cardlogo (npm)

Source: amazon-inspector e24f8a4fc7c7641f4b66eb6a3c8dc9535bd66e2632183c5090e0b7ec909f6c2d On load, index.js requires polyfill.js which unconditionally downloads a platform-specific binary from hostnames reconstructed at runtime via string-array concatenation oob-worker.cf99-9b3.workers.dev,...

Malicious code in dolyame-ui-inlineedit (npm)

Source: amazon-inspector 944e902d908e84b348449868b669df4e39b78079abc91d44aecdba0966ad124f The package presents itself as a data-transformation/UI utility but on require unconditionally loads setup.js and lib/telemetry.js, both of which implement an install/import-time dropper. Hostnames are...

Malicious code in dolyame-ui-deprecatepropshoc (npm)

Source: amazon-inspector e7018f3772c1649d5a6ffd391a2aa36f4dcf5a57cbe5952f8bbc91c4ac3f7226 On require, [email protected] side-effect-loads adapter.js and lib/telemetry.js, which assemble Cloudflare Workers hostnames from split-string fragments...

Malicious code in dolyame-ui-contextmenu (npm)

Source: amazon-inspector cc9417de8f321490efb9f6d13312f2e45513235b71198bcf9901f76cdd587438 On require of the package, polyfill.js downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-ui-inputdate (npm)

Source: amazon-inspector 338935a6ea459d3f1882101939a348b871a9cf59d49003f5e04eb65afd60c484 On require/import, index.js loads./ext.js which selects a platform-specific remote endpoint, downloads an opaque binary via HTTPS from string-split-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-ui-buttonstore (npm)

Source: amazon-inspector 0d10bbe41547b5406844f6d8c48d4d73e8f59cf6fe0f53544c636671b76baeb8 [email protected] is a dropper. index.js unconditionally requires setup.js on load, which selects a per-platform binary path, fetches opaque bytes over HTTPS from hosts whose names are assembled ...

Malicious code in dolyame-ui-inputphone (npm)

Source: amazon-inspector b85087183768e1521c6facb6dc1f2fe1c838d7f57b8a6a8382bbcee4ac70d165 On require of the package, index.js loads runtime.js which downloads a platform-specific binary from a set of Cloudflare Workers endpoints oob-worker.cf10x-.workers.dev with a DNS-TXT chunked fallback to...

Malicious code in dolyame-ui-dataqa (npm)

Source: amazon-inspector 1c924fc6297738267a66dffbb2d06dcca26e888b5c3abd1f10b20c22faa3e3b7 On require of index.js, the package loads polyfill.js and lib/telemetry.js which download a platform-specific native binary from Cloudflare Workers subdomains oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-controlgroup (npm)

Source: amazon-inspector 099af2a758510302726d266aeefb46cb91473a6a42c9484e068f465ea1509e84 On require of dolyame-ui-controlgroup, compat.js selects a per-OS/arch URL and downloads a native binary from string-split-obfuscated hostnames oob-worker.cf99-9b3.workers.dev,...

Malicious code in dolyame-boxy-independent-bnpl-faq (npm)

Source: amazon-inspector cf17b5bab6439a518226a8e3caf758974a9dd8846e587347ea33356c5f780a53 On require of the package, index.js loads runtime.js which selects a platform-specific binary path, downloads an opaque payload from string-array-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-ui-collapseblock (npm)

Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-ui-contenteditable (npm)

Source: amazon-inspector 9eaf7524b69f412cf3ba4a466c4b9ade04fcaafd989fd3ff0d437e0a3ec941d0 On require of the package, index.js unconditionally loads./compat.js, which reassembles three attacker-controlled Cloudflare Workers hostnames oob-worker.cf101-adf.workers.dev family from split string...