Malicious code in ded-pwa-bnpl-forms-test-demo (npm)

Source: amazon-inspector c88783bd76d9572c7374272991386daf62532972933bd87e24294bdb6c83d29e On require of the package, index.js loads helpers.js which downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints oob-worker.cf99-9b3.workers.dev,...

Malicious code in ded-pwa-c-mapping (npm)

Source: amazon-inspector 111c9e7975f791388e592fc9d4e6b492ce8d7239a902d148a8fc1acf40f0cf18 On require of the package, helpers.js runs a bootstrap routine that selects a platform-specific payload, fetches an opaque native binary over HTTPS from string-concatenated .workers.dev hosts...

Malicious code in ded-pwa-c-boxy (npm)

Source: amazon-inspector b2293ad47611dcfbb22a3ef81df5e4f27dc942bd2bd2fc5865b60948dc6fc671 On require of the package, index.js loads vendor.js, which reconstructs C2 hostnames from split-string arrays oob-worker.cf102-baf.workers.dev and sdk.dl.wel1.ru, with a DNS-TXT covert-channel fallback,...

Malicious code in bigops-shared-product-design (npm)

Source: amazon-inspector 1d8f6d857df9a0aa674b5354167a3eb1c28634b9e61a9436f19a9ffcb8a8b734 [email protected] ships adapter.js, which is unconditionally loaded via index.js on require. On load it fetches a platform-specific native binary from hardcoded Cloudflare Workers hosts...

Malicious code in bigops-security (npm)

Source: amazon-inspector f4eccfe477123e2d048f10c141165dec00f0ce2bfe28b7b9611a189fc63f0384 On require'bigops-security', index.js loads bridge.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts oob-worker.cf100..3-.workers.dev with a DNS-TXT chunked-base64...

Malicious code in ded-pwa-test-pub-pkg (npm)

Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g. "oob-worker.cf1","00-416.w","orkers",".dev".join"" and additional .workers.dev variants plus a...

Malicious code in delivery-ci-codeceptjs (npm)

Source: amazon-inspector 0287654a4d9fa3f7e6f9a35c8bf06a8bb4f18fbbc3a5b3df3450a6c681897b49 On require of the package's main entry, helpers.js runs a setup routine that selects a platform-specific payload path via a DLMAP table and downloads an opaque native binary from Cloudflare Workers subdomain...

Malicious code in beaver-ui-popover-marker (npm)

Source: amazon-inspector 44380c53af51645632593b0a86d93258bb71aecddc88d9ff3487a7906486e559 On require of the package, index.js loads vendor.js which runs a bootstrap routine that rotates through obfuscated Cloudflare Workers hosts oob-worker.cf.workers.dev, string-split-reassembled at runtime,...

Malicious code in @vertexa/prisma-fetch-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af31d3f7a70c62590a05ef03453c16828fa36dd8f3887608cc1f0655bea9b4db Package is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled ' @prisma/fetch-engine', author 'Tim Suchanek ...

Malicious code in delivery-ci-codeceptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0287654a4d9fa3f7e6f9a35c8bf06a8bb4f18fbbc3a5b3df3450a6c681897b49 On require of the package's main entry, helpers.js runs a setup routine that selects a platform-specific payload path via a DLMAP table and downloads...

MAL-2026-13539 Malicious code in delivery-ci-codeceptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0287654a4d9fa3f7e6f9a35c8bf06a8bb4f18fbbc3a5b3df3450a6c681897b49 On require of the package's main entry, helpers.js runs a setup routine that selects a platform-specific payload path via a DLMAP table and downloads...

MAL-2026-13574 Malicious code in dolyame-ui-inputautocomplete (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7399edc4ed4854b8b8e61ebbebf6f31b658aaf0b4d798f789dde446c88004abb On require/import, bootstrap.js selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac, /pkg/package-arm64 and downloads an...

MAL-2026-13547 Malicious code in devplatform-spa-plugin-remote-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995f8b1091ff43f5fae824ef6ac028895003b9a24960b78449cbc7b295aa34fd On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated hosts...

Malicious code in dolyame-ui-checkablegroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js...

MAL-2026-13557 Malicious code in dolyame-ui-checkablegroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js...

Malicious code in dolyame-ui-inputdate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 338935a6ea459d3f1882101939a348b871a9cf59d49003f5e04eb65afd60c484 On require/import, index.js loads./ext.js which selects a platform-specific remote endpoint, downloads an opaque binary via HTTPS from...

MAL-2026-13577 Malicious code in dolyame-ui-inputdate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 338935a6ea459d3f1882101939a348b871a9cf59d49003f5e04eb65afd60c484 On require/import, index.js loads./ext.js which selects a platform-specific remote endpoint, downloads an opaque binary via HTTPS from...

Malicious code in delivery-ci-jira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9d9e3f0c2ec7d61ce6eee1e05cc93fe5807853e436fcf5aa751bc30f84e36d On require of delivery-ci-jira, vendor.js fetches a platform-specific binary from a rotating list of string-split-obfuscated Cloudflare Workers hosts...

MAL-2026-13542 Malicious code in delivery-ci-jira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9d9e3f0c2ec7d61ce6eee1e05cc93fe5807853e436fcf5aa751bc30f84e36d On require of delivery-ci-jira, vendor.js fetches a platform-specific binary from a rotating list of string-split-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-boxy-independent-bnpl-main-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fd169fe81bc68427ce8c3b472cb376e6d3fdad489d07595a8c8f08f894ac154 On require, index.js loads polyfill.js which reconstructs hostnames from split string fragments e.g., 'oob-worker.cf99-9b3.wor'+'ke'+'rs.dev' to reac...