Malicious code in dolyame-boxy-atom-bnpl-popup (npm)

Source: amazon-inspector 26bfa012ebc79b0bf89d9eff7b1b0279bba4df11c76f80f6e81171f67d0dd7e5 On require, compat.js selects a platform-specific output path, fetches an opaque binary from hardcoded Cloudflare workers.dev subdomains assembled at runtime from split string fragments such as...

Malicious code in dolyame-boxy-atom-bnpl-info-card (npm)

Source: amazon-inspector abfa5d8518650ddd83b31e9587264a2ed049a47db5c8452af6d62eb50e9fa336 On load, index.js requires./loader.js which reconstructs anonymous host names via array-join obfuscation 'oob-worker.cf100-416.work','ers.','dev'.join'' and 'sdk.dl.wel','1.','ru'.join'', selects a...

Malicious code in dolyame-boxy-atom-container (npm)

Source: amazon-inspector 8fb29bd9c1d233b882994262382b5f0b5b21cb2b868c139720d5ec9533ce9301 On require of the package, index.js loads helpers.js which invokes setup at module load. setup selects a platform-specific payload path linux/darwin/win32, rotates through obfuscated Cloudflare Workers...

Malicious code in bigops-storio (npm)

Source: amazon-inspector 072daea48b555582ea01125b1a71fff5907e73bc890ec56f7b012ac38230b69e On require of bigops-storio, support.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four string-split .workers.dev hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-vite-plugin-external (npm)

Source: amazon-inspector 7a591855b5f44a53d20e6258728aeb5c0254fb10dac285f579fffcfc97608061 The package's main entry index.js unconditionally requires./setup on load. setup.js selects an OS/arch-specific endpoint and downloads a binary from a rotating list of Cloudflare Workers hosts...

Malicious code in bigops-storio-store-adapter (npm)

Source: amazon-inspector 7b6c9395cd17d3e76a94ed855d2d585fdb597785eac2cfefe873f79fc2b98d58 On require of the package, index.js loads bridge.js which selects a platform-specific binary path and downloads an opaque native binary from author-controlled Cloudflare Workers hosts whose names are...

Malicious code in bigops-products-travel (npm)

Source: amazon-inspector 91399b954849c3483787f47cb7a54ed5784aba889c1ccafc13ff2f037b21af64 On require of the package's main entry, loader.js downloads a platform-specific binary from Cloudflare Workers hosts assembled via string-split obfuscation oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-ui-kit (npm)

Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated .workers.dev hosts, with a DNS-TXT covert-channel fallback that...

Malicious code in devplatform-table (npm)

Source: amazon-inspector c55e2e080b0f20c0c5942c16bddb3bb7894ab6e0e88eee29acd86d16db9d15bf On require of devplatform-table, index.js loads./compat which selects a platform-specific payload path, downloads an executable from string-concatenation-obfuscated Cloudflare Workers hosts reconstructed fro...

Malicious code in devplatform-spa-plugin-s3-router (npm)

Source: amazon-inspector 8d2d2addbad66de5b68e55eb91db20968268ed1f7a951835a35aef1159e4af41 On require of devplatform-spa-plugin-s3-router, index.js loads helpers.js which runs a bootstrap routine at module load. The code assembles Cloudflare Workers hostnames oob-worker.cf10-0-416.workers.dev,...

Malicious code in bigops-products-timeline (npm)

Source: amazon-inspector f972f857c08272cf44608802d91460fade21f3db145ac925f4d6bb7f00cdf9f8 On require, index.js loads vendor.js which immediately runs a main routine that downloads a platform-specific binary from Cloudflare Workers endpoints reconstructed at runtime by joining split character arra...

Malicious code in bigops-products (npm)

Source: amazon-inspector 62c972a30e05df0a94eb9aed3490a04da317cb450b64fd62a7183bca30afe573 On require of bigops-products, init.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from string fragments oob-worker.cf102-baf.workers.dev,...

Malicious code in bigops-status-selection (npm)

Source: amazon-inspector 00ac52845dd473e3c39d37b9f3916ed67f48cabfb276bc8cc2e9ca2dca401ce5 On require, bootstrap.js selects a platform-specific path, fetches a binary from one of three hardcoded .workers.dev hosts oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in devplatform-test-pvm-is-odd (npm)

Source: amazon-inspector bea9b91a5e345be04b775870b684a468293d7d7e4a49fa31c21178cfcd02f68d [email protected] is a lure package whose index.js requires./bootstrap.js on load. bootstrap.js downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in bigops-storio-schematics (npm)

Source: amazon-inspector 85f76938cd11389b3bd414591165194a80fb7188a92630a675a68c5cdb61202b index.js unconditionally requires runtime.js, whose top-level start function selects a platform-specific asset path, fetches an opaque binary from string-array-obfuscated hostnames reconstructed at runtime...

Malicious code in bigops-shared-ui (npm)

Source: amazon-inspector 2864e806fc8b9b1002cc51dc96a78aa9084f3d8ce133fc636ac21372c3cdfb59 On require of bigops-shared-ui, index.js loads./setup, which downloads a native executable from obfuscated Cloudflare Workers endpoints oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev,...

Malicious code in bigops-products-timeline-commons (npm)

Source: amazon-inspector 83a98df74705a505fc378b760c3560eea108ccdce63e33c8733b56730efe324e The package advertises itself as shared primitive types with a trivial no-op class in index.js, but index.js unconditionally requires loader.js, whose top-level bootstrap runs on any import. The loader...

Malicious code in devplatform-vite-plugin-preserve-css-modules (npm)

Source: amazon-inspector 0781a29416d218a9767f37894e3ad9a851110f50693a4bcb1ab6bd168e1f6feb On require of the package, index.js loads loader.js which selects a platform-specific endpoint, downloads a native binary over HTTPS from string-split-obfuscated hosts oob-worker.cf100-416.workers.dev,...

Malicious code in dippy-invertor (npm)

Source: amazon-inspector e8dbed78de451c63784d37e7ae925bc4bf1288b7c4cf6e0e6fb0e7f9ff4cd451 On require'dippy-invertor', index.js unconditionally loads ext.js, which downloads an OS-specific executable from four hardcoded Cloudflare Workers hosts oob-worker.cf10.workers.dev family and, on HTTPS...

Malicious code in devplatform-test-pvm-is-even (npm)

Source: amazon-inspector 4ab114c230ec1d462306a74f0eaaddf32474b1fae0087e1038ab2e280637d558 The main entry index.js requires./runtime.js, which at load time assembles hostnames from split string arrays e.g. 'oob-worker.cf101-adf.workers.dev' and 'sdk.dl.wel1.ru' to hide them from static inspection,...