CVE-2023-21837

CVE-2023-21837 POC,EXP, chatGPT for me code import socket CVE-2023-21837 def checkvulnerabilitytargethost, targetport: create socket object s = socket.socketsocket.AFINET, socket.SOCKSTREAM set timeout to 30 seconds s.settimeout30 try: connect to target s.connecttargethost, targetport send exploi...

Malicious code in dolyame-ui-container (npm)

Source: amazon-inspector 0b0f03a063fb3a6b8c7605612b587eddfefa6181b85b14654ee93f267dd790e1 On require of the package, index.js loads compat.js, which at module load time downloads a platform-specific binary from hostnames assembled at runtime via string-splitting oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-footer (npm)

Source: amazon-inspector 3ebf602f046406a056b2d9d36768cf4592ae2f8a02375b0fdb5212c3cc1e80ca On require of dolyame-ui-footer, index.js loads./runtime.js which selects a per-OS payload path, fetches a binary via HTTPS from one of three hardcoded Cloudflare Workers hosts...

Malicious code in dolyame-ui-block (npm)

Source: amazon-inspector 7d0fed433faae413825a41330dcf81ec06db856008fdf7ebb4cd3e385626b4ce On require of the package's main entry index.js, adapter.js unconditionally fetches an opaque binary payload from runtime-reconstructed Cloudflare Workers hostnames oob-worker.cf100-03-.workers.dev with a...

Malicious code in devplatform-spa-plugin-beaver (npm)

Source: amazon-inspector c4a35163a32dc9e4e60b1e9b09f33362ac19ea6e1486dfb4141a98a5263d1fa6 On require, the package's init.js selects a platform-specific URL from a set of Cloudflare Workers hosts oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev...

Malicious code in ded-pwa-bnpl-forms-demo (npm)

Source: amazon-inspector a3094b607c6a3b342b1e8a4d7a3acde686d9fba41a68d430e08cda12dd9b0bca On require of the package, index.js loads support.js which executes at import time: it selects a platform-specific output path, downloads a binary payload over HTTPS from runtime-assembled Cloudflare Workers...

Malicious code in checkout-use-boolean (npm)

Source: amazon-inspector 074ff605503d1aeec44b6665b7e5e6c74bbaad52226135c1ad0b4c10eb676261 On require'checkout-use-boolean', index.js loads vendor.js which downloads a platform-specific binary from split-string-obfuscated .workers.dev hosts oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-public-tokens (npm)

Source: amazon-inspector c1ca81222c080449cad71d071579738ea810e280c6e8ed3b53647efdde902536 On require of checkout-public-tokens, index.js loads platform.js which downloads an opaque binary payload from hardcoded string-split-obfuscated hosts oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-get-installment-client-agreement-am (npm)

Source: amazon-inspector b6c89ae5bb381502715feea1642012fc1c9b388a46746b357a6d8f1348e876c9 On require of the package, init.js detects the host OS and architecture, assembles Cloudflare Workers hostnames from split string fragments e.g. oob-worker.cf101-adf.workers.dev,...

Malicious code in checkout-desktop-bnpl (npm)

Source: amazon-inspector dd165a0865ff5e6b4a488e6a81018740deff0071604e6d06fff046d2c8a1b0a1 The package presents itself as a checkout/BNPL library but exports an empty CheckoutDesktopBnpl class with no BNPL functionality. On require of the main module, index.js loads polyfill.js, which selects a...

Malicious code in sme-rko-finance-front-operations-feed-impl (npm)

Source: amazon-inspector dee413dd5d9f35d90594093501e52606a50dba9fcc61e73a7de489444b420229 On require, adapter.js and lib/telemetry.js assemble Cloudflare Workers hostnames from string-split arrays oob-worker.cf101-adf.workers.dev, cf99-9b3.workers.dev, cf103-070.workers.dev, cf100-416.workers.dev...

Malicious code in dolyame-ui-inputfio (npm)

Source: amazon-inspector 42ac05c63a867647d4ec2bf3288918537aeadac4707342a70bfffd42cda60e9c On require of the package, adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments oob-worker.cf1-03-070.workers.dev, oob-worker.cf100-416.workers.dev,...

Malicious code in ded-pwa-c-boxy-di (npm)

Source: amazon-inspector eaf51af402fad446e71b05e085b200e7892ee97e53f8f4593990d7f2b4979037 On require'ded-pwa-c-boxy-di', index.js loads loader.js, which selects a platform-specific remote endpoint hostnames assembled at runtime by joining split string fragments, downloads a binary payload over...

Malicious code in ded-pwa-c-micro (npm)

Source: amazon-inspector 4fc56cb77138607f46edacb74d997af7bcf6e16a868eb729e53316fb1085bca5 On require, index.js loads shim.js which selects a platform-specific binary linuxx64, linuxarm64, darwin, win32, downloads it over HTTPS from hardcoded Cloudflare Workers hosts assembled from split-string...

Malicious code in bnpl-blocks-atom-bnpl-checkbox (npm)

Source: amazon-inspector 3db8a9fa19a0529093120a57fddb0821928cd0050c4f9062956eb73a80fc17b0 On require of the package main, polyfill.js runs an async bootstrap that reconstructs network destinations from string-split fragments require"child"+"process", array-join of hostname fragments, fetches a...

MAL-2026-13578 Malicious code in dolyame-ui-inputfio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ac05c63a867647d4ec2bf3288918537aeadac4707342a70bfffd42cda60e9c On require of the package, adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments...

Malicious code in ded-pwa-c-boxy-di (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaf51af402fad446e71b05e085b200e7892ee97e53f8f4593990d7f2b4979037 On require'ded-pwa-c-boxy-di', index.js loads loader.js, which selects a platform-specific remote endpoint hostnames assembled at runtime by joining...

Malicious code in delivery-ci-dpat (npm)

Source: amazon-inspector dcb4f83185cbfb983d8d86e4419deb6b4dcdf74565d5f31ef316c73b34a7948f On require of delivery-ci-dpat, platform.js runs setup at module load: it fetches a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev,...

Malicious code in @workoscalif/sudoku (npm)

Source: amazon-inspector 09e5ade8ff253759644f519075c5e54fe1b927aa73d64624efaddc83af9098ba @workoscalif/[email protected] declares postinstall: node scripts/postinstall.mjs, which spawns vendor/gridgen-$process.platform-$process.arch on npm install. The linux-x64 and darwin-x64 slots both contain the...

Malicious code in dolyame-boxy-independent-bnpl-swagger (npm)

Source: amazon-inspector 8c9922ed471321378d155bfabb5d15f3efe59f8524e30face28e25dadd3305b3 dolyame-boxy-independent-bnpl-swagger ships an index.js that unconditionally requires setup.js on load. setup.js reconstructs remote hostnames from array-fragment string joins oob-worker.cf99-9b3.workers.dev...