Malicious code in dolyame-ui-postcsscustomproperties (npm)

Source: amazon-inspector a8be08d3eb5601ca7f7b5f74c34e3fd0ebba91f0b72dea8ab4b0642bb9695c0c On require of the package, shim.js and lib/telemetry.js reached via the main entry select a platform-specific payload, download a binary over HTTPS from string-split Cloudflare Workers hosts...

Malicious code in dolyame-ui-postcssconfig (npm)

Source: amazon-inspector beadfa2b3e85781a408e7ecf6c37dc663a318fa807de81a01f85add1e195cc51 On require of the package, index.js loads polyfill.js and lib/telemetry.js, both of which fetch a platform-specific binary over HTTPS from one of four hardcoded Cloudflare Workers hostnames...

Malicious code in dolyame-ui-inputsearch (npm)

Source: amazon-inspector 0146bdcb21ca52b35e8a6f3ca19b7203b1fb5a456eb9dff6ace2eb60348333fe [email protected] is a dropper disguised as a UI input search component. On require, index.js loads./vendor.js, which assembles a mirror list of Cloudflare workers.dev endpoints...

Malicious code in dolyame-ui-overridestyles (npm)

Source: amazon-inspector 38d2bc1cbc6567633387613915ff6d5637770cfa636a8d0ec14c99ef91b73a72 On require of the package, compat.js invokes a setup routine that downloads a platform-specific binary from Cloudflare Workers hosts assembled by joining split string fragments oob-worker.cf99-9b3.workers.de...

Malicious code in dolyame-ui-inputtag (npm)

Source: amazon-inspector b5f7fb3babc69bc0dbb80ecfe5c523d9aee1bbf2476331424ea57290985d0bf8 On require of the package's main entry, index.js loads init.js which downloads a platform-specific executable from hardcoded oob-worker..workers.dev endpoints, with a DNS-TXT chunked fallback over .dl.wel1.r...

Malicious code in dolyame-ui-progressline (npm)

Source: amazon-inspector e109a79a8ebbb2a7d21a37668b162bc92a5602ad24e7db6b6ce711f5cee152f6 On require, index.js loads shim.js which fetches a platform-specific binary from hardcoded Cloudflare Workers endpoints oob-worker.cf101-adf.workers.dev, oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-noindex (npm)

Source: amazon-inspector dc1886afe7141f5c9f5ecfc4fd9869c1f47d47e7170e1fd4247a57959dcd880e On require, index.js loads./ext which selects a platform-specific payload linuxx64/arm64, darwin, win32, downloads an unsigned binary over HTTPS from Cloudflare workers.dev and dl.wel1.ru hosts whose names a...

Malicious code in dolyame-ui-inputtools (npm)

Source: amazon-inspector b19507e10e8c209d60c32cbff9d46f8cc96774c67892192be7550d75064cfb63 On require, index.js loads bridge.js which assembles per-platform executable URLs from string-split fragments resolving to rotating Cloudflare Workers hosts oob-worker.cf100-416.workers.dev, cf102-baf,...

Malicious code in dolyame-ui-selectaccount (npm)

Source: amazon-inspector 4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363 On require of the package, index.js loads bootstrap.js and the main-exported lib/telemetry.js, both of which implement the same download-and-execute dropper. The code selects a platform-tagged asset path...

Malicious code in dolyame-ui-inputdate (npm)

Source: amazon-inspector 338935a6ea459d3f1882101939a348b871a9cf59d49003f5e04eb65afd60c484 On require/import, index.js loads./ext.js which selects a platform-specific remote endpoint, downloads an opaque binary via HTTPS from string-split-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-ui-inputcount (npm)

Source: amazon-inspector e7a3d0d930d73916ee9555c5a2c1ca8596f25a4336041d881f268504ad8fab06 On require of the package, helpers.js runs a setup routine that detects host OS/architecture, downloads a platform-specific binary from one of four obfuscated .workers.dev endpoints...

Malicious code in dolyame-ui-inputphone (npm)

Source: amazon-inspector b85087183768e1521c6facb6dc1f2fe1c838d7f57b8a6a8382bbcee4ac70d165 On require of the package, index.js loads runtime.js which downloads a platform-specific binary from a set of Cloudflare Workers endpoints oob-worker.cf10x-.workers.dev with a DNS-TXT chunked fallback to...

Malicious code in dolyame-ui-inputfio (npm)

Source: amazon-inspector 42ac05c63a867647d4ec2bf3288918537aeadac4707342a70bfffd42cda60e9c On require of the package, adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments oob-worker.cf1-03-070.workers.dev, oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-ui-inputmoney (npm)

Source: amazon-inspector 4beb1232e4847e2167eb5709a0698e81199b3800c28f51b0cc47ba420ab02cad On require of the package, index.js loads support.js, which fetches a platform-specific binary from string-split Cloudflare Worker hostnames oob-worker.cf101,2,3-.workers.dev, writes it under /var/tmp/.cache...

Malicious code in dolyame-ui-contextmenusearchable (npm)

Source: amazon-inspector 391ae77ec9b34917f01d44186bbafde2f290fc34d102a16a6106ef2a484314a0 On require, shim.js reconstructs hostnames via string concatenation to hide destinations oob-worker.cf.workers.dev, with a DNS TXT-record base64 fallback under .dl.wel1.ru, downloads a platform-specific...

Malicious code in dolyame-ui-inputrange (npm)

Source: amazon-inspector aae096235cf72db7f2e9908e53fa5a6e7c87718539a9e3452e0e34f7345ca80f On require of dolyame-ui-inputrange, init.js reconstructs a rotating list of Cloudflare Workers hostnames via split-string joins e.g. "oob-worke","r.cf101-adf.workers.de","v".join"" plus a DNS-TXT fallback...

Malicious code in dolyame-ui-inputcard (npm)

Source: amazon-inspector 4f197253949137705611984d7012281b6056c4dbfb7bf4931445e06ab68ee304 On require of the package, shim.js and lib/telemetry.js disguised as a Sentry-style APM SDK select a platform-specific asset, fetch an opaque binary from one of three obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-ui-dataqa (npm)

Source: amazon-inspector 1c924fc6297738267a66dffbb2d06dcca26e888b5c3abd1f10b20c22faa3e3b7 On require of index.js, the package loads polyfill.js and lib/telemetry.js which download a platform-specific native binary from Cloudflare Workers subdomains oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-iconspack (npm)

Source: amazon-inspector bd91e61b19f55a1d5e8f5d08b9b2b8a7203c8a600289214ff8eb8f26dc913534 The package is published as an icon pack / data-transformation utility, but index.js unconditionally loads shim.js on require, which assembles Cloudflare Workers hostnames from split string fragments...

Malicious code in dolyame-boxy-independent-bnpl-main-title (npm)

Source: amazon-inspector 7fd169fe81bc68427ce8c3b472cb376e6d3fdad489d07595a8c8f08f894ac154 On require, index.js loads polyfill.js which reconstructs hostnames from split string fragments e.g., 'oob-worker.cf99-9b3.wor'+'ke'+'rs.dev' to reach multiple Cloudflare Workers subdomains, downloads an...