Malicious code in dolyame-boxy-independent-bnpl-cards (npm)

Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-boxy-independent-bnpl-features (npm)

Source: amazon-inspector 5f65bcb53883eb5b3dcd6fe4d8b8ee61e24dad3323aa4ee4431a62b770e17f7a On require, bridge.js downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints oob-worker.cf100-416.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev...

Malicious code in dolyame-boxy-independent-bnpl-partners (npm)

Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation oob-worker..workers.dev variants and sdk/ext/pkg/net.dl.wel1.ru,...

Malicious code in dolyame-boxy-independent-bnpl-info-slider (npm)

Source: amazon-inspector dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681 On require of the package, index.js loads vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-boxy-mobile-bnpl-button-set (npm)

Source: amazon-inspector ce4829363e0b5248ca374f2bd545b219d5235bbc96936ba5bd9d06f369878538 On require, index.js loads shim.js which selects a platform-specific endpoint from a set of runtime-assembled Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev, oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-independent-bnpl-search (npm)

Source: amazon-inspector 4f29e1e3b6b3a01a935dbcd19077e516c17d31c3674078ecfe2cd112b0137437 On require, index.js loads init.js which reconstructs hostnames from split-string arrays e.g. 'oob-worker.cf102','-baf.workers.','dev'.join'' and 'sdk.dl.','wel1.ru'.join'' to build URLs against four...

Malicious code in dolyame-boxy-mobile-bnpl-card-gallery (npm)

Source: amazon-inspector d25f027b45e1dd0483fdacb92c8af5b25302f2785de7a7a5c259b8d535597d80 On require of the package, bootstrap.js fetches an opaque binary over HTTPS from a rotating list of Cloudflare Workers subdomains with a DNS-TXT chunked-retrieval fallback to .wel1.ru, writes it to...

Malicious code in dolyame-boxy-independent-bnpl-scheme (npm)

Source: amazon-inspector bce523b3385816616192d462b5ac251d22886682d021200c4bd76bd22b95003c On require of this package, index.js loads setup.js which downloads a platform-specific native binary from author-controlled Cloudflare Workers hosts with a DNS TXT fallback via sdk.dl.wel1.ru, writes it to...

Malicious code in dolyame-boxy-independent-bnpl-main-banner (npm)

Source: amazon-inspector e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698 index.js unconditionally requires./bridge on load. bridge.js selects a per-platform payload linux x64/arm64, darwin, win32, fetches a native binary over HTTPS from a hardcoded list of Cloudflare .workers.dev...

Malicious code in dolyame-boxy-atom-bnpl-store-button-set (npm)

Source: amazon-inspector bdce627f475557b2376352c5dbc9cc8970949fdccef36073a4665c01fe4af92f On require, index.js loads platform.js which reconstructs download hostnames from split-and-joined array literals e.g. oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-boxy-atom-desktop-bnpl-container (npm)

Source: amazon-inspector 736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd On require, index.js loads bootstrap.js, which reconstructs remote hosts by array.join string concatenation oob-worker.cf100-416.workers.dev, cf101-adf.workers.dev, cf103-070.workers.dev, with a .dl.wel1.ru...

Malicious code in dolyame-boxy-atom-desktop-bnpl-text (npm)

Source: amazon-inspector 5b63e38f9a4be0ffccf426124ce23e7d5c0ddfde68cc81ad44cbfe75ef22c31c The package's index.js silently loads loader.js via a swallowed try/catch try require'./loader'; catch . loader.js assembles one of three Cloudflare Workers hostnames via array-join string-splitting...

Malicious code in dolyame-boxy-desktop-bnpl-picture-gallery (npm)

Source: amazon-inspector 1ac9b6ff477d28984f8498e58ccc09c6addc4ecce2816fd46f25e5b4cfca49dc On require of this package, index.js loads bridge.js which auto-executes an init routine that fetches a platform-specific binary from runtime-assembled Cloudflare Workers hosts assembled from split fragments...

Malicious code in dolyame-boxy-atom-bnpl-image-card (npm)

Source: amazon-inspector 484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f The package's main entry loads setup.js, which on require fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are reconstructed at runtime via array.join e.g...

Malicious code in dolyame-boxy-desktop-bnpl-title (npm)

Source: amazon-inspector 51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee The package main index.js requires ./init on load. init.js assembles hostnames via string-split .join'' obfuscation to produce a rotating list of Cloudflare Workers endpoints oob-worker.cf103-070.workers.dev...

Malicious code in dolyame-boxy-desktop-bnpl-card-gallery (npm)

Source: amazon-inspector 3e20a9180ff2928b0498496b59c96983db044063b8db7c5e258b6518d5daf00a On require of this package, index.js loads bridge.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-desktop-bnpl-hero-title (npm)

Source: amazon-inspector 036c11daa7712014748d57bc2bca8a37672acffa8f3eaca83161b726ba473fdb On require of the package, helpers.js reassembles hostnames from split string arrays e.g. 'oob-worker.cf102-baf.workers.dev', 'oob-worker.cf100-416.workers.dev', 'oob-worker.cf103-070.workers.dev' and...

Malicious code in dolyame-boxy-atom-bnpl-dangerously-html (npm)

Source: amazon-inspector 48ce2aa10d245536ed6cfd1903fe1b553eef84d8e949b0bd1b970817b7f13e98 On require of the package, index.js loads loader.js which reconstructs attacker-controlled hostnames via string-split.join'' to evade scanners mirrors of the form oob-worker.cf100,1,2-baf,adf.workers.dev and...

Malicious code in dolyame-boxy-atom-bnpl-card (npm)

Source: amazon-inspector 7992916c62a9926f06f313367b6b684674413ecac4fe8cf1e0130165ae651fc7 On require of the package, index.js loads adapter.js, which downloads a platform-specific native binary from hardcoded destinations assembled via array-join concatenation oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-boxy-desktop-bnpl-footer (npm)

Source: amazon-inspector 5bdd69d6a0625e30b3c7764f12685db79bacb5c01e092772a38bbd7019addf54 Requiring dolyame-boxy-desktop-bnpl-footer causes platform.js to execute at load time: it reconstructs destination hostnames from split string arrays oob-worker.cf102-baf.workers.dev,...