Malicious code in devplatform-test-pvm-is-odd (npm)

Source: amazon-inspector bea9b91a5e345be04b775870b684a468293d7d7e4a49fa31c21178cfcd02f68d [email protected] is a lure package whose index.js requires./bootstrap.js on load. bootstrap.js downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in dippy-invertor (npm)

Source: amazon-inspector e8dbed78de451c63784d37e7ae925bc4bf1288b7c4cf6e0e6fb0e7f9ff4cd451 On require'dippy-invertor', index.js unconditionally loads ext.js, which downloads an OS-specific executable from four hardcoded Cloudflare Workers hosts oob-worker.cf10.workers.dev family and, on HTTPS...

Malicious code in bigops-storio-store-adapter (npm)

Source: amazon-inspector 7b6c9395cd17d3e76a94ed855d2d585fdb597785eac2cfefe873f79fc2b98d58 On require of the package, index.js loads bridge.js which selects a platform-specific binary path and downloads an opaque native binary from author-controlled Cloudflare Workers hosts whose names are...

Malicious code in devplatform-spa-ui (npm)

Source: amazon-inspector fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428 On require, vendor.js selects a per-OS payload URL, fetches a binary from rotating .workers.dev hosts with a DNS-TXT base64 fallback via .dl.wel1.ru, writes it to a hidden temp path .cache on Unix,...

Malicious code in docflow-cryptopro (npm)

Source: amazon-inspector b838ab488feb43fe2b50d6cd00579d3c1528877ea84d935ca89d8d863528bd25 On require of the package's main, platform.js downloads an opaque platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames assembled from split string fragments such as...

Malicious code in bigops-statements-timeline (npm)

Source: amazon-inspector d10168eeae00c6455a6a5a4838aa1afc9460a1edbc287d0b6f8b4acab5eae316 On require of the package, index.js loads support.js which selects a platform-specific asset path and downloads a binary over HTTPS from a rotating list of anonymous Cloudflare Workers subdomains...

Malicious code in devplatform-vite-plugin-external (npm)

Source: amazon-inspector 7a591855b5f44a53d20e6258728aeb5c0254fb10dac285f579fffcfc97608061 The package's main entry index.js unconditionally requires./setup on load. setup.js selects an OS/arch-specific endpoint and downloads a binary from a rotating list of Cloudflare Workers hosts...

Malicious code in devplatform-spa-plugin-s3 (npm)

Source: amazon-inspector 8ca84ec076b60ced1412d45476eb90fb5c797b8dd53a5151d474dc979a085565 [email protected] is a binary dropper. index.js unconditionally requires shim.js, whose top-level init fetches a platform-specific binary over HTTPS from destinations reassembled at runtime by...

Malicious code in devplatform-utils (npm)

Source: amazon-inspector 0244bc7396ea5f52d909130a7d685fee98c0dda29cb18b82d17e8c9c90dff552 [email protected] ships an index.js whose main module requires bootstrap.js, which on load downloads a platform-specific binary payload from string-split-obfuscated Cloudflare Workers endpoints e.g...

Malicious code in devplatform-sre-devplatform-sre-core (npm)

Source: amazon-inspector 90a5c16f77f85cd9f782efd521d9f6d2b677ab2468503d191d8763c400f366b8 On require of this package, index.js loads helpers.js which selects an OS/arch-specific path and downloads a native binary from one of three Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev,...

Malicious code in devplatform-vite-plugin-gle (npm)

Source: amazon-inspector 81ba08fb4c9c52336f51b45ebe9089ba0b441f3da79529ac1c56f146d71861b6 On require, support.js assembles C2 hostnames via split/join fragments resolving to oob-worker.cf100-416.workers.dev, cf103-070.workers.dev, cf101-adf.workers.dev and downloads a platform-specific binary via...

Malicious code in bigops-products-savings-accounts (npm)

Source: amazon-inspector 390c683f6a93a099bb09a5590ebc84cd61391ee25d553d009350117c142a9c43 On require of bigops-products-savings-accounts, ext.js reconstructs C2 hostnames via Array.join to defeat static search, fetches a platform-specific opaque binary from oob-worker.cf101-adf.workers.dev with a...

Malicious code in bigops-products-timeline (npm)

Source: amazon-inspector f972f857c08272cf44608802d91460fade21f3db145ac925f4d6bb7f00cdf9f8 On require, index.js loads vendor.js which immediately runs a main routine that downloads a platform-specific binary from Cloudflare Workers endpoints reconstructed at runtime by joining split character arra...

Malicious code in bigops-products-timeline-commons (npm)

Source: amazon-inspector 83a98df74705a505fc378b760c3560eea108ccdce63e33c8733b56730efe324e The package advertises itself as shared primitive types with a trivial no-op class in index.js, but index.js unconditionally requires loader.js, whose top-level bootstrap runs on any import. The loader...

Malicious code in bigops-products-investment (npm)

Source: amazon-inspector 91a3c32ddd31a89386c67c18f6dcc9d80d621671986dbb9a059927dfcf749411 Requiring [email protected] loads vendor.js at import time, which fetches a platform-specific executable from one of several Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev,...

Malicious code in bigops-nitro-client (npm)

Source: amazon-inspector bfbd116994566a3e99f61697a738787d8089c2c99dbc9d5c55f9f3902a6b8cff On require, index.js loads vendor.js which downloads a platform-specific native binary from rotating Cloudflare Workers endpoints oob-worker.cf103-070.workers.dev, oob-worker.cf100-416.workers.dev,...

Malicious code in bigops-products-loans (npm)

Source: amazon-inspector bee9ea7bc129d916b60d18e41425309fc1191d8d7688f1536d500f455f6d4c9a On require of bigops-products-loans, index.js loads init.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev,...

Malicious code in bigops-nitro-events-table (npm)

Source: amazon-inspector 6d222994e1816e63b4047f5396bbfda8d6d2ccd6bbc840da4872aa026f879525 The package's index.js requires./shim on load. shim.js selects a platform-specific payload path, fetches an executable via https.get from one of three Cloudflare Workers hostnames reconstructed from...

Malicious code in bigops-opening-file-handler (npm)

Source: amazon-inspector 9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39 On require of bigops-opening-file-handler, index.js loads support.js which selects a platform-specific asset linux/darwin/win32 and downloads an opaque native binary from one of four hardcoded Cloudflare...

Malicious code in bigops-offers (npm)

Source: amazon-inspector 422359e6c8044efa7c3873ff0859acb1480ea95413cbfb8829dc4c674de6f8d5 [email protected] executes a binary dropper at require time. index.js loads./init on import; init.js assembles C2 hostnames from split string arrays workers.dev subdomains oob-worker.cf100-416.workers.dev...