Malicious code in dolyame-boxy-independent-bnpl-mobile-application (npm)

Source: amazon-inspector 31565660321da87adf5d579f4608cd6059c88afd2c95a04eb7223031881572f7 The package's top-level index.js unconditionally requires./platform on load. platform.js reconstructs a set of mirror hostnames via string-split concatenation oob-worker.cf101-adf.workers.dev family and a...

Malicious code in dolyame-boxy-independent-bnpl-video (npm)

Source: amazon-inspector f3490fd11839adb1f5027facaf8046cd19e640fffdbf79d0684c91a565dd8303 On require of the package's main entry, index.js loads adapter.js which performs OS/arch detection and fetches an opaque binary from string-split-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-boxy-independent-bnpl-features (npm)

Source: amazon-inspector 5f65bcb53883eb5b3dcd6fe4d8b8ee61e24dad3323aa4ee4431a62b770e17f7a On require, bridge.js downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev...

Malicious code in dolyame-boxy-mobile-bnpl-button-set (npm)

Source: amazon-inspector ce4829363e0b5248ca374f2bd545b219d5235bbc96936ba5bd9d06f369878538 On require, index.js loads shim.js which selects a platform-specific endpoint from a set of runtime-assembled Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-mobile-bnpl-header (npm)

Source: amazon-inspector 405339008cf0f3e8c17a5e982b006c85c7f9f8110bbdc6531b4c6f71c2fbabb0 On require of the package, shim.js assembles remote hostnames at runtime by joining split string fragments four Cloudflare Workers subdomains such as oob-worker.cf101-adf.workers.dev / cf103-070 / cf102-baf ...

Malicious code in dolyame-boxy-mobile-bnpl-card-panel (npm)

Source: amazon-inspector 81f9a7ce9653fe40c88e75d2eebba37ae255fd0eb7e71cd9e962d34db491a218 On require, bootstrap.js downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-independent-bnpl-separator (npm)

Source: amazon-inspector 273880296b11c362e48b0d7b6d2795c56f8726937482462bee9e615943572d46 On load, index.js unconditionally requires platform.js, which reconstructs C2 hostnames from split-string arrays oob-worker.cf.workers.dev with fallbacks to sdk.dl.wel1.ru, pkg.dl.wel1.ru, ext.dl.wel1.ru,...

Malicious code in dolyame-boxy-independent-bnpl-preset-container (npm)

Source: amazon-inspector 84696fc788619027dfd5efa2c8a27158b9afb95af39201163586f7fc5f27bd1a index.js requires platform.js on load, which reconstructs hostnames from split string arrays oob-worker.cf10-.workers.dev and sdk.dl.wel1.ru to hide destinations from static inspection, then HTTPS-fetches an...

Malicious code in dolyame-boxy-independent-bnpl-navigation (npm)

Source: amazon-inspector 2a3d08e3dbef59d66846b1b2ef0080f02c8f2c3597eb4725db3c6f62c8fcb231 index.js unconditionally requires./loader on load. loader.js selects a platform-specific payload path linuxx64, linuxarm64, darwin, win32 and downloads a binary from Cloudflare Workers hostnames assembled at...

Malicious code in dolyame-boxy-independent-bnpl-info-slider (npm)

Source: amazon-inspector dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681 On require of the package, index.js loads vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-boxy-independent-bnpl-cards (npm)

Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-boxy-independent-bnpl-button (npm)

Source: amazon-inspector cfda80d3053a8c106f2665b5c1a9a9235532a4acca7abd2a436b5c69fe7673d6 On require of the package's main entry, runtime.js fetches an opaque native binary from anonymous Cloudflare workers.dev subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-boxy-independent-bnpl-partners (npm)

Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation oob-worker..workers.dev variants and sdk/ext/pkg/net.dl.wel1.ru,...

Malicious code in dolyame-boxy-fonts (npm)

Source: amazon-inspector 00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3 On require of dolyame-boxy-fonts, index.js unconditionally loads./loader.js, which reconstructs C2 hostnames from split-string arrays Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-desktop-bnpl-picture-gallery (npm)

Source: amazon-inspector 1ac9b6ff477d28984f8498e58ccc09c6addc4ecce2816fd46f25e5b4cfca49dc On require of this package, index.js loads bridge.js which auto-executes an init routine that fetches a platform-specific binary from runtime-assembled Cloudflare Workers hosts assembled from split fragments...

Malicious code in dolyame-boxy-atom-bnpl-dolyame-button (npm)

Source: amazon-inspector c249dddf9e2ab4659fe99f1945e7b6dd832178da7b207fa86923d8c23ae60143 On require, adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-atom-bnpl-image-card (npm)

Source: amazon-inspector 484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f The package's main entry loads setup.js, which on require fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are reconstructed at runtime via array.join e.g...

Malicious code in dolyame-boxy-desktop-bnpl-header (npm)

Source: amazon-inspector 626b386d1f127bc0ed973dbac051023f0f021b0be476d1cd8678802ef98c5d42 On require of the package, index.js unconditionally loads bootstrap.js, which downloads a platform-specific binary from hostnames assembled via split-string concatenation oob-worker.cf103-070.workers.dev,...

Malicious code in dolyame-boxy-atom-bnpl-card (npm)

Source: amazon-inspector 7992916c62a9926f06f313367b6b684674413ecac4fe8cf1e0130165ae651fc7 On require of the package, index.js loads adapter.js, which downloads a platform-specific native binary from hardcoded destinations assembled via array-join concatenation oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-boxy-atom-bnpl-badge (npm)

Source: amazon-inspector 31ecc1e21adbb7890afdc37d9e00e09d56b9b66fc9793603884569d8beed29d7 On require of dolyame-boxy-atom-bnpl-badge, helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors oob-worker.cf100-.workers.dev, oob-worker.cf102-.workers.dev,...