Malicious code in dolyame-boxy-atom-bnpl-info-card (npm)

Source: amazon-inspector abfa5d8518650ddd83b31e9587264a2ed049a47db5c8452af6d62eb50e9fa336 On load, index.js requires./loader.js which reconstructs anonymous host names via array-join obfuscation 'oob-worker.cf100-416.work','ers.','dev'.join'' and 'sdk.dl.wel','1.','ru'.join'', selects a...

Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from string-split-obfuscated .workers.dev mirrors...

Malicious code in dolyame-boxy-atom-bnpl-badge (npm)

Source: amazon-inspector 31ecc1e21adbb7890afdc37d9e00e09d56b9b66fc9793603884569d8beed29d7 On require of dolyame-boxy-atom-bnpl-badge, helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors oob-worker.cf100-.workers.dev, oob-worker.cf102-.workers.dev,...

Malicious code in docsmate-docsmate-core (npm)

Source: amazon-inspector 9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev and siblings cf100-416, cf101-adf, cf102-baf from split string fragments, with a DNS-TXT...

Malicious code in dolyame-boxy-atom-container (npm)

Source: amazon-inspector 8fb29bd9c1d233b882994262382b5f0b5b21cb2b868c139720d5ec9533ce9301 On require of the package, index.js loads helpers.js which invokes setup at module load. setup selects a platform-specific payload path linux/darwin/win32, rotates through obfuscated Cloudflare Workers...

Malicious code in dolyame-boxy-desktop-bnpl-header (npm)

Source: amazon-inspector 626b386d1f127bc0ed973dbac051023f0f021b0be476d1cd8678802ef98c5d42 On require of the package, index.js unconditionally loads bootstrap.js, which downloads a platform-specific binary from hostnames assembled via split-string concatenation oob-worker.cf103-070.workers.dev,...

Malicious code in dolyame-boxy-atom-bnpl-text (npm)

Source: amazon-inspector fdafe79f11030f0367fb997cf61cabd383309aca2ba694459be72a97d8023bb7 On require of the package, index.js loads helpers.js which immediately runs an init routine that fetches a platform-specific binary over HTTPS from a set of hosts reassembled at runtime via string...

Malicious code in dolyame-boxy-desktop-bnpl-text-block (npm)

Source: amazon-inspector c8c756707c26d481934a28ab399aa9cb9db769f3785006b83a97f519ca90f241 On require, index.js loads./platform.js, which assembles OS-specific download URLs from fragmented string pieces pointing at Cloudflare Workers subdomains oob-worker.cf-.workers.dev, fetches an opaque...

Malicious code in dolyame-boxy-desktop-bnpl-button-set (npm)

Source: amazon-inspector 5f786ddb8f05c51044f41661db16ceb96657060ba36d0ead043d430cf4e30a11 Requiring the package loads vendor.js, which reconstructs remote hosts from array-join fragments resolving to Cloudflare Workers hosts such as oob-worker.cf.workers.dev and a .dl.wel1.ru fallback discovered...

Malicious code in bigops-products-travel (npm)

Source: amazon-inspector 91399b954849c3483787f47cb7a54ed5784aba889c1ccafc13ff2f037b21af64 On require of the package's main entry, loader.js downloads a platform-specific binary from Cloudflare Workers hosts assembled via string-split obfuscation oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-supafetch (npm)

Source: amazon-inspector 8dc92f63aa9d199fde2a42c1298a9c620b5823b5252d16c9450456e5efbb154d [email protected] is advertised as a fetch helper but on require drops and executes an opaque native binary. index.js unconditionally loads./ext.js, which selects a platform-specific payload path...

Malicious code in bigops-storio (npm)

Source: amazon-inspector 072daea48b555582ea01125b1a71fff5907e73bc890ec56f7b012ac38230b69e On require of bigops-storio, support.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four string-split .workers.dev hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-vite-plugin-gle (npm)

Source: amazon-inspector 81ba08fb4c9c52336f51b45ebe9089ba0b441f3da79529ac1c56f146d71861b6 On require, support.js assembles C2 hostnames via split/join fragments resolving to oob-worker.cf100-416.workers.dev, cf103-070.workers.dev, cf101-adf.workers.dev and downloads a platform-specific binary via...

Malicious code in bigops-storio-ngrx (npm)

Source: amazon-inspector 6eb386f3b0d35ecf71762d0e719f883a3e1e207a2a3a9e1f52e7729de7753ae0 On require, index.js loads./ext.js which selects a per-OS asset path and downloads a binary payload from one of three runtime-assembled Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev,...

Malicious code in bigops-products-savings-accounts (npm)

Source: amazon-inspector 390c683f6a93a099bb09a5590ebc84cd61391ee25d553d009350117c142a9c43 On require of bigops-products-savings-accounts, ext.js reconstructs C2 hostnames via Array.join to defeat static search, fetches a platform-specific opaque binary from oob-worker.cf101-adf.workers.dev with a...

Malicious code in devplatform-sre-devplatform-sre-core (npm)

Source: amazon-inspector 90a5c16f77f85cd9f782efd521d9f6d2b677ab2468503d191d8763c400f366b8 On require of this package, index.js loads helpers.js which selects an OS/arch-specific path and downloads a native binary from one of three Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev,...

Malicious code in devplatform-spa-plugin-s3-router (npm)

Source: amazon-inspector 8d2d2addbad66de5b68e55eb91db20968268ed1f7a951835a35aef1159e4af41 On require of devplatform-spa-plugin-s3-router, index.js loads helpers.js which runs a bootstrap routine at module load. The code assembles Cloudflare Workers hostnames oob-worker.cf10-0-416.workers.dev,...

Malicious code in bigops-products-timeline-commons (npm)

Source: amazon-inspector 83a98df74705a505fc378b760c3560eea108ccdce63e33c8733b56730efe324e The package advertises itself as shared primitive types with a trivial no-op class in index.js, but index.js unconditionally requires loader.js, whose top-level bootstrap runs on any import. The loader...

Malicious code in bigops-rx-post-message (npm)

Source: amazon-inspector 1298706de8e41561be6743e6d8349c5feefb81bec1ba71f3f2da3995d845ac98 On require of bigops-rx-post-message, index.js executes init.js at module top level, which downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from...

Malicious code in bigops-products-timeline (npm)

Source: amazon-inspector f972f857c08272cf44608802d91460fade21f3db145ac925f4d6bb7f00cdf9f8 On require, index.js loads vendor.js which immediately runs a main routine that downloads a platform-specific binary from Cloudflare Workers endpoints reconstructed at runtime by joining split character arra...