Malicious code in dolyame-ui-action (npm)

Source: amazon-inspector f91017d9e387f2441738f4ffe07ce8807a3af9385f2c506cf165fa851d011f53 On require'dolyame-ui-action', index.js loads support.js which downloads a platform-specific binary over HTTPS from Cloudflare Workers hosts whose names are reconstructed at runtime from split string arrays...

Malicious code in devplatform-select-user (npm)

Source: amazon-inspector e2f7e22a3a99d2447b8bc3e6c0b1f4a92077ce570fdacff421e9fdee6a83e723 On require, the package loads bridge.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers mirrors oob-worker.cf99-9b3.workers.dev, cf101-adf.workers.dev,...

Malicious code in devplatform-nx-devkit (npm)

Source: amazon-inspector cc4017373371f50665290c944ee840b2ad4a7e745dcb5eb973f977185b150ac7 The package presents as a devkit for the Nx ecosystem but ships a trivial no-op class in index.js alongside a hidden shim.js. On require, index.js unconditionally invokes require'./shim', which reconstructs...

Malicious code in devplatform-jscodeshift-transforms (npm)

Source: amazon-inspector 37b642060b8d602b0de19c132a792a4979dafc0cb06590dc2f10d14fe0980151 On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts destinations reconstructed via string-split concatenation such as...

Malicious code in devplatform-integrations-tests-lib (npm)

Source: amazon-inspector 5a69dc1ca445f24f40d0b4b24dc010a7d85c8994c65d215f2c6e5efe5dfac28f On require, bootstrap.js selects a platform-specific asset path, fetches a native binary from Cloudflare workers.dev hosts e.g. oob-worker.cf101-adf.workers.dev with a DNS-TXT fallback to .dl.wel1.ru, writes...

Malicious code in delivery-ci-validate-tinkoff-fb (npm)

Source: amazon-inspector 1c2b95894675a32af7552c62bb8cd49bbd1d69f64d2685118ed2fede54c0b1a0 The package presents itself as a CI validation helper but index.js calls require'./adapter' on import, causing adapter.js to run automatically. adapter.js assembles C2 hostnames at runtime via .join'' over...

Malicious code in claims-to-iso-string-with-timezone (npm)

Source: amazon-inspector c313bb681d365fedf6993c01c72c1e6e703b2b5124c8c35c19a730d5b2d4f7aa On require of claims-to-iso-string-with-timezone, index.js loads./init.js which downloads a platform-specific binary from obfuscated author-controlled endpoints Cloudflare Workers hostnames...

Malicious code in checkout-mobile-bnpl (npm)

Source: amazon-inspector 0734507ccd6f61cb81c277d9e9215c90f0b8cff1bd16f0c3eacd399750d26b4f index.js requires./helpers on load. helpers.js reconstructs three Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev from...

Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm)

Source: amazon-inspector 7c602d22e5a0f1d7cee18a98a7ce0b67e2c8440f7ff95330cb6c33d169f2e629 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct the identifier 'childprocess' and destination hostnames from split string fragments e.g...

Malicious code in sme-rko-finance-front-operations-pegasus (npm)

Source: amazon-inspector f4ad5f5c931a19daf4fd3f939fc2ed4f1ef2bb034800563cd2ad687f1fbe2364 On require, index.js loads shim.js which downloads a platform-specific binary from runtime-assembled .workers.dev hostnames with a DNS TXT fallback channel resolving through sdk/ext/pkg/net.dl.wel1.ru, write...

Malicious code in sme-rko-finance-front-payments-domain (npm)

Source: amazon-inspector d8fcad12c3078bf2134f5e3cafd7ffa0ecf9f2bfec919533881d5c65b738b9fa On require of the package, index.js loads./polyfill.js which assembles a set of C2 hostnames from split string fragments via.join'' — resolving to oob-worker.cf99-9b3.workers.dev,...

Malicious code in sme-rko-finance-front-operations-domain (npm)

Source: amazon-inspector e254c7a7e7f82c38dddb46c9c694cef8f91ac1731565c61e7d17b30d291bd7ac On require of the package, index.js loads shim.js which self-executes an async initializer that assembles platform-specific hostnames from split-string arrays e.g...

Malicious code in dolyame-ui-contextmenusearchable (npm)

Source: amazon-inspector 391ae77ec9b34917f01d44186bbafde2f290fc34d102a16a6106ef2a484314a0 On require, shim.js reconstructs hostnames via string concatenation to hide destinations oob-worker.cf.workers.dev, with a DNS TXT-record base64 fallback under .dl.wel1.ru, downloads a platform-specific...

Malicious code in ded-pwa-bnpl-forms-test-demo (npm)

Source: amazon-inspector c88783bd76d9572c7374272991386daf62532972933bd87e24294bdb6c83d29e On require of the package, index.js loads helpers.js which downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints oob-worker.cf99-9b3.workers.dev,...

Malicious code in dolyame-boxy-desktop-bnpl-card-gallery (npm)

Source: amazon-inspector 3e20a9180ff2928b0498496b59c96983db044063b8db7c5e258b6518d5daf00a On require of this package, index.js loads bridge.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-desktop-bnpl-footer (npm)

Source: amazon-inspector 5bdd69d6a0625e30b3c7764f12685db79bacb5c01e092772a38bbd7019addf54 Requiring dolyame-boxy-desktop-bnpl-footer causes platform.js to execute at load time: it reconstructs destination hostnames from split string arrays oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-boxy-desktop-bnpl-title (npm)

Source: amazon-inspector 51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee The package main index.js requires ./init on load. init.js assembles hostnames via string-split .join'' obfuscation to produce a rotating list of Cloudflare Workers endpoints oob-worker.cf103-070.workers.dev...

Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from string-split-obfuscated .workers.dev mirrors...

Malicious code in bigops-product-list (npm)

Source: amazon-inspector 173f02a73c0c5d6ee6ac7bb757fa64aef91178cfb38c4772d30260c9a7ea4bc1 index.js unconditionally requires setup.js on module load. setup.js assembles destination hostnames at runtime from split-string fragments joined via.join"" to hide them from static scanners, selects a...

Malicious code in bigops-products-loans (npm)

Source: amazon-inspector bee9ea7bc129d916b60d18e41425309fc1191d8d7688f1536d500f455f6d4c9a On require of bigops-products-loans, index.js loads init.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev,...