Malicious code in claims-constants (npm)

Source: amazon-inspector b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b The package's index.js unconditionally requires./helpers.js, whose top-level main executes on import. It downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains...

Malicious code in dolyame-ui-progressline (npm)

Source: amazon-inspector e109a79a8ebbb2a7d21a37668b162bc92a5602ad24e7db6b6ce711f5cee152f6 On require, index.js loads shim.js which fetches a platform-specific binary from hardcoded Cloudflare Workers endpoints oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev,...