Malicious code in dolyame-ui-contenteditable (npm)

Source: amazon-inspector 9eaf7524b69f412cf3ba4a466c4b9ade04fcaafd989fd3ff0d437e0a3ec941d0 On require of the package, index.js unconditionally loads./compat.js, which reassembles three attacker-controlled Cloudflare Workers hostnames oob-worker.cf101-adf.workers.dev family from split string...

Malicious code in dolyame-ui-generateid (npm)

Source: amazon-inspector 1db498e928fa247c2f3efbee2eaea516e60b450483e29d3537bac04061cbffdf On require of the package, index.js loads shim.js which selects a platform-specific payload URL by concatenating string fragments to reconstruct hostnames oob-worker.cf103-070.workers.dev,...

Malicious code in dolyame-ui-cardlogo (npm)

Source: amazon-inspector e24f8a4fc7c7641f4b66eb6a3c8dc9535bd66e2632183c5090e0b7ec909f6c2d On load, index.js requires polyfill.js which unconditionally downloads a platform-specific binary from hostnames reconstructed at runtime via string-array concatenation oob-worker.cf99-9b3.workers.dev,...

Malicious code in devplatform-stylelint-config (npm)

Source: amazon-inspector 0d5c417e542790e2e91860f8383960eecead75556b747c0fdc91227c3228f514 The package is published as 'devplatform-stylelint-config' with description 'environment config reader' and exposes a trivial ConfigLoader from index.js, but index.js also requires./setup.js which runs at...

Malicious code in dolyame-ui-iconspack (npm)

Source: amazon-inspector bd91e61b19f55a1d5e8f5d08b9b2b8a7203c8a600289214ff8eb8f26dc913534 The package is published as an icon pack / data-transformation utility, but index.js unconditionally loads shim.js on require, which assembles Cloudflare Workers hostnames from split string fragments...

Malicious code in devplatform-spa-plugin-remote-module (npm)

Source: amazon-inspector 995f8b1091ff43f5fae824ef6ac028895003b9a24960b78449cbc7b295aa34fd On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated hosts oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev,...

Malicious code in dolyame-ui-inputdate (npm)

Source: amazon-inspector 338935a6ea459d3f1882101939a348b871a9cf59d49003f5e04eb65afd60c484 On require/import, index.js loads./ext.js which selects a platform-specific remote endpoint, downloads an opaque binary via HTTPS from string-split-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-ui-inputcard (npm)

Source: amazon-inspector 4f197253949137705611984d7012281b6056c4dbfb7bf4931445e06ab68ee304 On require of the package, shim.js and lib/telemetry.js disguised as a Sentry-style APM SDK select a platform-specific asset, fetch an opaque binary from one of three obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-ui-dataqa (npm)

Source: amazon-inspector 1c924fc6297738267a66dffbb2d06dcca26e888b5c3abd1f10b20c22faa3e3b7 On require of index.js, the package loads polyfill.js and lib/telemetry.js which download a platform-specific native binary from Cloudflare Workers subdomains oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-inputcount (npm)

Source: amazon-inspector e7a3d0d930d73916ee9555c5a2c1ca8596f25a4336041d881f268504ad8fab06 On require of the package, helpers.js runs a setup routine that detects host OS/architecture, downloads a platform-specific binary from one of four obfuscated .workers.dev endpoints...

Malicious code in devplatform-eslint-config (npm)

Source: amazon-inspector de0fcdb30a4308ee477f432e1bcc665e8ee45f3dd36dd02f22089a4b9e2a69f9 [email protected] ships no ESLint configuration despite its name and description. Requiring the package loads compat.js, which on import selects a payload path based on OS/architecture linuxx6...

Malicious code in devplatform-api-v1-resources (npm)

Source: amazon-inspector 58312f0f83e88c3dbd6f62bc334db255d0e3d5c6aed0d8d859dd0b17ce77557c On require of the package's main entry, setup.js fetches a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at runtime from fragment arrays e.g. oob-worker.cf101-.workers.de...

Malicious code in delivery-ci-cli (npm)

Source: amazon-inspector 25daa792f30733f69d4530266b44c1b6ba9a5f4d11f47cce95b714792a39ca89 On require of delivery-ci-cli, index.js loads bootstrap.js which downloads a platform-specific native binary from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf102-baf.workers.dev,...

Malicious code in delivery-ci-jira (npm)

Source: amazon-inspector dd9d9e3f0c2ec7d61ce6eee1e05cc93fe5807853e436fcf5aa751bc30f84e36d On require of delivery-ci-jira, vendor.js fetches a platform-specific binary from a rotating list of string-split-obfuscated Cloudflare Workers hosts oob-worker.cf102-baf.workers.dev,...

Malicious code in damir-cbr-dawdntrnssbf (npm)

Source: amazon-inspector b201b86e8198a519343eebfaa548af8848dcad42b507826b052f5c97fbcfa90f On require of the package, polyfill.js downloads a platform-specific binary from attacker-controlled Cloudflare Workers hosts oob-worker.cf10x-.workers.dev with a DNS TXT-record chunked-base64 fallback chann...

Malicious code in bnpl-blocks-atom-bnpl-image-card (npm)

Source: amazon-inspector abfb9fc4e628aff9ca7ab9df6b7a2b65c27eb1a094e4d64ff002a98f35eb58e1 On require, index.js loads bridge.js which selects a platform-specific asset path, fetches a binary over HTTPS from runtime-assembled Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

Malicious code in bnpl-blocks-atom-bnpl-checkbox (npm)

Source: amazon-inspector 3db8a9fa19a0529093120a57fddb0821928cd0050c4f9062956eb73a80fc17b0 On require of the package main, polyfill.js runs an async bootstrap that reconstructs network destinations from string-split fragments require"child"+"process", array-join of hostname fragments, fetches a...

Malicious code in bnpl-blocks-atom-bnpl-loader (npm)

Source: amazon-inspector e219aa368cf93296783647d204c970e9302c41fab778d953471f7ce905f3dfdc On any require/import of this package, index.js loads setup.js, which reassembles four oob-worker.cf.workers.dev hostnames from split string fragments, downloads a platform-specific native binary linuxx64,...

Malicious code in ded-pwa-c-micro (npm)

Source: amazon-inspector 4fc56cb77138607f46edacb74d997af7bcf6e16a868eb729e53316fb1085bca5 On require, index.js loads shim.js which selects a platform-specific binary linuxx64, linuxarm64, darwin, win32, downloads it over HTTPS from hardcoded Cloudflare Workers hosts assembled from split-string...

Malicious code in ded-pwa-c-boxy-di (npm)

Source: amazon-inspector eaf51af402fad446e71b05e085b200e7892ee97e53f8f4593990d7f2b4979037 On require'ded-pwa-c-boxy-di', index.js loads loader.js, which selects a platform-specific remote endpoint hostnames assembled at runtime by joining split string fragments, downloads a binary payload over...