Malicious code in ded-pwa-c-boxy-di (npm)

Source: amazon-inspector eaf51af402fad446e71b05e085b200e7892ee97e53f8f4593990d7f2b4979037 On require'ded-pwa-c-boxy-di', index.js loads loader.js, which selects a platform-specific remote endpoint hostnames assembled at runtime by joining split string fragments, downloads a binary payload over...

Malicious code in ded-pwa-test-pub-pkg (npm)

Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g. "oob-worker.cf1","00-416.w","orkers",".dev".join"" and additional .workers.dev variants plus a...

Malicious code in bnpl-blocks-atom-bnpl-faq-item (npm)

Source: amazon-inspector bcd2fbb910548df40180cd1e71ae6234dddbd8c60b871933d9012bab9f0742bb The package's main entry index.js requires./ext at module load. ext.js downloads a platform-specific binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in ded-pwa-bnpl-forms-test-demo (npm)

Source: amazon-inspector c88783bd76d9572c7374272991386daf62532972933bd87e24294bdb6c83d29e On require of the package, index.js loads helpers.js which downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints oob-worker.cf99-9b3.workers.dev,...

Malicious code in ded-pwa-c-micro (npm)

Source: amazon-inspector 4fc56cb77138607f46edacb74d997af7bcf6e16a868eb729e53316fb1085bca5 On require, index.js loads shim.js which selects a platform-specific binary linuxx64, linuxarm64, darwin, win32, downloads it over HTTPS from hardcoded Cloudflare Workers hosts assembled from split-string...

Malicious code in ded-pwa-c-boxy (npm)

Source: amazon-inspector b2293ad47611dcfbb22a3ef81df5e4f27dc942bd2bd2fc5865b60948dc6fc671 On require of the package, index.js loads vendor.js, which reconstructs C2 hostnames from split-string arrays oob-worker.cf102-baf.workers.dev and sdk.dl.wel1.ru, with a DNS-TXT covert-channel fallback,...

Malicious code in delivery-ci-codeceptjs (npm)

Source: amazon-inspector 0287654a4d9fa3f7e6f9a35c8bf06a8bb4f18fbbc3a5b3df3450a6c681897b49 On require of the package's main entry, helpers.js runs a setup routine that selects a platform-specific payload path via a DLMAP table and downloads an opaque native binary from Cloudflare Workers subdomain...

Malicious code in damir-cbr-dawdntrnssbf (npm)

Source: amazon-inspector b201b86e8198a519343eebfaa548af8848dcad42b507826b052f5c97fbcfa90f On require of the package, polyfill.js downloads a platform-specific binary from attacker-controlled Cloudflare Workers hosts oob-worker.cf10x-.workers.dev with a DNS TXT-record chunked-base64 fallback chann...

Malicious code in bnpl-blocks-atom-bnpl-checkbox (npm)

Source: amazon-inspector 3db8a9fa19a0529093120a57fddb0821928cd0050c4f9062956eb73a80fc17b0 On require of the package main, polyfill.js runs an async bootstrap that reconstructs network destinations from string-split fragments require"child"+"process", array-join of hostname fragments, fetches a...

Malicious code in bigops-security (npm)

Source: amazon-inspector f4eccfe477123e2d048f10c141165dec00f0ce2bfe28b7b9611a189fc63f0384 On require'bigops-security', index.js loads bridge.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts oob-worker.cf100..3-.workers.dev with a DNS-TXT chunked-base64...

Malicious code in bnpl-blocks-atom-bnpl-loader (npm)

Source: amazon-inspector e219aa368cf93296783647d204c970e9302c41fab778d953471f7ce905f3dfdc On any require/import of this package, index.js loads setup.js, which reassembles four oob-worker.cf.workers.dev hostnames from split string fragments, downloads a platform-specific native binary linuxx64,...

Malicious code in devplatform-spa-errors (npm)

Source: amazon-inspector 5cb27f42d7166d8e64db0a98a48a18f64817d801d1e4b6250c62320f08143d59 On require of the package, index.js unconditionally loads loader.js, which selects a platform-specific payload path, fetches an opaque native binary from string-concatenated Cloudflare Workers subdomains...

Malicious code in devplatform-api-v1-resources (npm)

Source: amazon-inspector 58312f0f83e88c3dbd6f62bc334db255d0e3d5c6aed0d8d859dd0b17ce77557c On require of the package's main entry, setup.js fetches a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at runtime from fragment arrays e.g. oob-worker.cf101-.workers.de...

Malicious code in delivery-ci-documentation (npm)

Source: amazon-inspector af740a7d6bb84ba6086ce037139d5e0a6008c308db58069c184fff16e0a4a203 On require'delivery-ci-documentation', index.js loads init.js which selects a platform-specific payload endpoint, reconstructs destination hostnames at runtime by joining split string arrays, and downloads a...

Malicious code in ded-pwa-c-mapping (npm)

Source: amazon-inspector 111c9e7975f791388e592fc9d4e6b492ce8d7239a902d148a8fc1acf40f0cf18 On require of the package, helpers.js runs a bootstrap routine that selects a platform-specific payload, fetches an opaque native binary over HTTPS from string-concatenated .workers.dev hosts...

Malicious code in devplatform-spa-plugin-feature-toggle (npm)

Source: amazon-inspector 2d61b9d430e59b37ce3c13873e37c1dd146d468b6a06f462761e2214acd1d0fa [email protected] executes attacker-controlled code on the installer's host at module import. The package's main entry loads support.js, which builds three hardcoded origins under...

Malicious code in devplatform-eslint-config (npm)

Source: amazon-inspector de0fcdb30a4308ee477f432e1bcc665e8ee45f3dd36dd02f22089a4b9e2a69f9 [email protected] ships no ESLint configuration despite its name and description. Requiring the package loads compat.js, which on import selects a payload path based on OS/architecture linuxx6...

Malicious code in delivery-ci-core (npm)

Source: amazon-inspector 8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335 index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev,...

Malicious code in delivery-ci-cli (npm)

Source: amazon-inspector 25daa792f30733f69d4530266b44c1b6ba9a5f4d11f47cce95b714792a39ca89 On require of delivery-ci-cli, index.js loads bootstrap.js which downloads a platform-specific native binary from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf102-baf.workers.dev,...

Malicious code in delivery-ci-jira (npm)

Source: amazon-inspector dd9d9e3f0c2ec7d61ce6eee1e05cc93fe5807853e436fcf5aa751bc30f84e36d On require of delivery-ci-jira, vendor.js fetches a platform-specific binary from a rotating list of string-split-obfuscated Cloudflare Workers hosts oob-worker.cf102-baf.workers.dev,...