Malicious code in dolyame-boxy-desktop-bnpl-card-gallery (npm)

Source: amazon-inspector 3e20a9180ff2928b0498496b59c96983db044063b8db7c5e258b6518d5daf00a On require of this package, index.js loads bridge.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-desktop-bnpl-text-block (npm)

Source: amazon-inspector c8c756707c26d481934a28ab399aa9cb9db769f3785006b83a97f519ca90f241 On require, index.js loads./platform.js, which assembles OS-specific download URLs from fragmented string pieces pointing at Cloudflare Workers subdomains oob-worker.cf-.workers.dev, fetches an opaque...

Malicious code in dolyame-boxy-atom-bnpl-dolyame-button (npm)

Source: amazon-inspector c249dddf9e2ab4659fe99f1945e7b6dd832178da7b207fa86923d8c23ae60143 On require, adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-fonts (npm)

Source: amazon-inspector 00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3 On require of dolyame-boxy-fonts, index.js unconditionally loads./loader.js, which reconstructs C2 hostnames from split-string arrays Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-atom-desktop-bnpl-container (npm)

Source: amazon-inspector 736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd On require, index.js loads bootstrap.js, which reconstructs remote hosts by array.join string concatenation oob-worker.cf100-416.workers.dev, cf101-adf.workers.dev, cf103-070.workers.dev, with a .dl.wel1.ru...

Malicious code in dolyame-boxy-desktop-bnpl-image-plus-text (npm)

Source: amazon-inspector 4501ea4e0c044573a1d76bf04ee806de26c33bd1dc38f21a2d1f00988a96e656 On require of this package, index.js loads compat.js which selects platform-specific endpoints assembled from split string arrays e.g. oob-worker.cf10-baf.workers.dev, oob-worker.cf99-9b3.workers.dev,...

Malicious code in dolyame-boxy-desktop-bnpl-hero-title (npm)

Source: amazon-inspector 036c11daa7712014748d57bc2bca8a37672acffa8f3eaca83161b726ba473fdb On require of the package, helpers.js reassembles hostnames from split string arrays e.g. 'oob-worker.cf102-baf.workers.dev', 'oob-worker.cf100-416.workers.dev', 'oob-worker.cf103-070.workers.dev' and...

Malicious code in dolyame-boxy-atom-desktop-bnpl-dangerously-html (npm)

Source: amazon-inspector f2f3a20016e1936bdca56ddd0208270b791b048a3d4c7cca682ff83462724bb2 On require of the package, index.js unconditionally loads polyfill.js, which downloads a platform-specific binary from Cloudflare Workers subdomains whose hostnames are reconstructed at runtime by joining...

Malicious code in dolyame-boxy-desktop-bnpl-title (npm)

Source: amazon-inspector 51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee The package main index.js requires ./init on load. init.js assembles hostnames via string-split .join'' obfuscation to produce a rotating list of Cloudflare Workers endpoints oob-worker.cf103-070.workers.dev...

Malicious code in dolyame-boxy-desktop-bnpl-button-set (npm)

Source: amazon-inspector 5f786ddb8f05c51044f41661db16ceb96657060ba36d0ead043d430cf4e30a11 Requiring the package loads vendor.js, which reconstructs remote hosts from array-join fragments resolving to Cloudflare Workers hosts such as oob-worker.cf.workers.dev and a .dl.wel1.ru fallback discovered...

Malicious code in dolyame-boxy-block (npm)

Source: amazon-inspector 919c54c4e8e0b08b62f76b85369a9033929f8ea19dfc777b8ece48697229a5ce [email protected] ships a runtime.js module that is unconditionally required from index.js at load time. On import, runtime.js reconstructs attacker-controlled hostnames from split string arrays e.g...

Malicious code in dolyame-boxy-atom-bnpl-dangerously-html (npm)

Source: amazon-inspector 48ce2aa10d245536ed6cfd1903fe1b553eef84d8e949b0bd1b970817b7f13e98 On require of the package, index.js loads loader.js which reconstructs attacker-controlled hostnames via string-split.join'' to evade scanners mirrors of the form oob-worker.cf100,1,2-baf,adf.workers.dev and...

Malicious code in dolyame-boxy-atom-bnpl-store-button-set (npm)

Source: amazon-inspector bdce627f475557b2376352c5dbc9cc8970949fdccef36073a4665c01fe4af92f On require, index.js loads platform.js which reconstructs download hostnames from split-and-joined array literals e.g. oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in docsmate-docsmate-core (npm)

Source: amazon-inspector 9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev and siblings cf100-416, cf101-adf, cf102-baf from split string fragments, with a DNS-TXT...

Malicious code in dolyame-boxy-atom-desktop-bnpl-text (npm)

Source: amazon-inspector 5b63e38f9a4be0ffccf426124ce23e7d5c0ddfde68cc81ad44cbfe75ef22c31c The package's index.js silently loads loader.js via a swallowed try/catch try require'./loader'; catch . loader.js assembles one of three Cloudflare Workers hostnames via array-join string-splitting...

Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from string-split-obfuscated .workers.dev mirrors...

Malicious code in dolyame-boxy-atom-bnpl-button (npm)

Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.dev with a DNS-TXT chunked-base64 fallback channel to...

Malicious code in dolyame-boxy-atom-bnpl-text (npm)

Source: amazon-inspector fdafe79f11030f0367fb997cf61cabd383309aca2ba694459be72a97d8023bb7 On require of the package, index.js loads helpers.js which immediately runs an init routine that fetches a platform-specific binary over HTTPS from a set of hosts reassembled at runtime via string...

Malicious code in dolyame-boxy-independent-bnpl-breadcrumbs (npm)

Source: amazon-inspector 95d52abe2ced4314ede2df4d3475d73fb87f52298434cdbf6469bf057613346f index.js unconditionally requires./init at module load time. init.js selects a platform-specific path, fetches an opaque native binary over HTTPS from a rotating set of Cloudflare Workers subdomains whose...

Malicious code in dolyame-boxy-atom-desktop-bnpl-highlighted-text (npm)

Source: amazon-inspector 539999c456d5c8a3f5e2028b9bd7a0f8ca3ab41af3c67044ef7735e0c9f76845 On require, polyfill.js selects a platform-specific payload, fetches an executable from one of three Cloudflare Workers hosts whose names are assembled at runtime from split string arrays to evade static...