91901 matches found
Malicious code in bigops-products-mobile (npm)
Source: amazon-inspector 265e87afdb04434bf53739963fd1c91ddb80c8ac957384377898c0aaf87cf826 On require'bigops-products-mobile', index.js loads loader.js which selects a platform-specific binary path, fetches attacker-controlled bytes over HTTPS from obfuscated Cloudflare Workers hosts...
Malicious code in bigops-products-bnpl (npm)
Source: amazon-inspector 79495f4d434b2f860f25315bc4c035d0db6956c8184ccb9a8068d1f6a4a15673 On require'bigops-products-bnpl', index.js loads runtime.js, which selects a platform-specific endpoint and downloads an opaque binary from one of four hardcoded Cloudflare Workers hosts...
Malicious code in bigops-nitro-events-table (npm)
Source: amazon-inspector 6d222994e1816e63b4047f5396bbfda8d6d2ccd6bbc840da4872aa026f879525 The package's index.js requires./shim on load. shim.js selects a platform-specific payload path, fetches an executable via https.get from one of three Cloudflare Workers hostnames reconstructed from...
Malicious code in bigops-products-deposits (npm)
Source: amazon-inspector a5f53755fd64cd249daeb83c1f148b5f4e600e4f59cc07cfa99fe6579992b0a9 On require of this package, index.js loads runtime.js which auto-invokes an init routine that selects a platform-specific endpoint, downloads a binary over HTTPS from hostnames reconstructed via string-array...
Malicious code in bigops-procedure-file-handlers (npm)
Source: amazon-inspector 0c15f49a67f4aa7071f4143a57c729f98dae58b01eb58ac77aabc666f1a1dda0 On require of the package, runtime.js downloads a platform-specific executable from obfuscated Cloudflare Workers endpoints hostnames reassembled at runtime via array-join, e.g. oob-worker.cf99-9b3.workers.d...
Malicious code in bigops-legacy-telephony-panel (npm)
Source: amazon-inspector 610b2084c8573d9a89262f1a4dcd8ff26acdcc0568f7fa29ac5a921a292e390a On require of this package, index.js loads init.js which at module load fetches a platform-specific binary from hostnames reassembled at runtime from split string arrays oob-worker.cf10-1-adf.workers.dev,...
Malicious code in bigops-plugin-notification-builder (npm)
Source: amazon-inspector 829800a4393389fef48ff06ea586a4892215acc428700193652bd1f3ce3f71b0 On require/import, index.js unconditionally loads bridge.js, which fetches a platform-specific binary from hardcoded, string-split-obfuscated Cloudflare Workers hosts oob-worker.cf102-baf.workers.dev,...
Malicious code in bigops-notes (npm)
Source: amazon-inspector 51b318f6ad8ba92430c504fd94111609cc003a62f8bce36e3c1f41308b195dae On require of bigops-notes, bootstrap.js selects a platform-specific asset, downloads an opaque binary from one of four runtime-assembled .workers.dev hostnames oob-worker.cf103-070.workers.dev,...
Malicious code in bigops-procedure-player (npm)
Source: amazon-inspector 4e28923577eff8eba09d7ebbd941220727c1851cf46ef25f4de8960070ad33bb On require, index.js loads loader.js, which reconstructs delivery hostnames at runtime via array.join"" e.g. oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.de...
Malicious code in bigops-product-list (npm)
Source: amazon-inspector 173f02a73c0c5d6ee6ac7bb757fa64aef91178cfb38c4772d30260c9a7ea4bc1 index.js unconditionally requires setup.js on module load. setup.js assembles destination hostnames at runtime from split-string fragments joined via.join"" to hide them from static scanners, selects a...
Malicious code in bigops-opening-file-handler (npm)
Source: amazon-inspector 9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39 On require of bigops-opening-file-handler, index.js loads support.js which selects a platform-specific asset linux/darwin/win32 and downloads an opaque native binary from one of four hardcoded Cloudflare...
Malicious code in bigops-products-insurance (npm)
Source: amazon-inspector 3f2dd9bdb83df26b3425759cb4579da8e3a2748a5c995370ce1095c6010abf3c On require, index.js loads ext.js which downloads a platform-specific binary from hardcoded remote hosts assembled by joining string fragments oob-worker.cf100-3-.workers.dev and sdk/ext/pkg/net.dl.wel1.ru,...
Malicious code in bigops-microfrontend (npm)
Source: amazon-inspector 53767eeec6e6f398e15ba75b3143b7fba8eb0a803579e2788a55163393bb2789 index.js unconditionally requires./shim on load. shim.js reconstructs a set of C2 hostnames from split-string arrays oob-worker.cf99-9b3.workers.dev, cf101-adf, cf102-baf, cf103-070.workers.dev, selects a...
Malicious code in bigops-jsonpath-mapper (npm)
Source: amazon-inspector 784552abf30d07bd647e0c3844dc45ea0205cf20c166ca1e38ef924c5fd999b7 On require of bigops-jsonpath-mapper, index.js loads bridge.js which assembles hostnames from string-array joins to hide the destinations oob-worker.cf99-9b3.workers.dev, cf101-adf.workers.dev,...
Malicious code in bigops-outgoing-call (npm)
Source: amazon-inspector 536ee260eadf72447df4e01eb549a86779846d21b3b9b539b486f2bcd65ba750 On require of index.js the package loads runtime.js, which selects a platform-specific asset path and fetches an opaque binary from one of four Cloudflare Workers hosts whose names are assembled via...
Malicious code in bigops-insite (npm)
Source: amazon-inspector cbe91d01b6f87752714ea87b8c79ecdda9497faf4a99709118330640cfaf46a2 On require'bigops-insite', index.js top-level loads./setup.js, which downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains oob-worker.cf102-baf.workers.dev,...
Malicious code in bigops-logs-player (npm)
Source: amazon-inspector f5a922558781f9614bc47976e2e695cc8a5996ef51865fb5b37928f842718b5d On require of bigops-logs-player, index.js loads polyfill.js, which reconstructs a list of Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev,...
Malicious code in bigops-products-loans (npm)
Source: amazon-inspector bee9ea7bc129d916b60d18e41425309fc1191d8d7688f1536d500f455f6d4c9a On require of bigops-products-loans, index.js loads init.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev,...
Malicious code in new-native-tools-linux-x64-gnu (npm)
Source: amazon-inspector c713b56fdb956dbd0caaa24969878e04aba9374f65d5fcfb8139771a012ff7cc The package's only shipped artifact is a 10 MB Linux x8664 ELF Node addon set as main tools.linux-x64-gnu.node, so it is loaded automatically on require. Extracted strings from the binary contain the exact...
