Malicious code in certificates-revocation-utils (npm)

Source: amazon-inspector 4f10384b425fd13237d69f5a9d71f6c893bd9063b32be2665f8a30f95ddda837 On module load, index.js requires vendor.js which fetches a platform-specific binary from runtime-reconstructed Cloudflare Workers hostnames assembled via split-string concatenation such as...

Malicious code in sme-rko-finance-front-operations-notifications-models (npm)

Source: amazon-inspector e1d9ca70f719a1aa76a11ce147945ee7acefdb72bcbf955d1c7cd30a5d9f85e8 On require of the package, index.js side-effect loads polyfill.js and lib/telemetry.js, both of which act as native-binary droppers. Hostnames and privileged API names are assembled via array.join'' to evade...

Malicious code in beaver-ui-form-modal (npm)

Source: amazon-inspector 37c4d60b5b32e6639dcecb7661afe72c6f5bb9ce486e53a398e81e11932f7379 On require'beaver-ui-form-modal', index.js loads shim.js which downloads a platform-specific binary from string-array-obfuscated Cloudflare Worker subdomains oob-worker.cf99-9b3.workers.dev,...