Malicious code in dolyame-ui-iconloaderhoc (npm)

Source: amazon-inspector 812cef02743987901661dc22ace6c19fee82977c4bb73b05ee046698ad603932 On require of the package's main entry, [email protected] executes two dropper paths that fetch platform-specific binaries from hardcoded Cloudflare workers.dev endpoints...

Malicious code in dolyame-boxy-independent-bnpl-button (npm)

Source: amazon-inspector cfda80d3053a8c106f2665b5c1a9a9235532a4acca7abd2a436b5c69fe7673d6 On require of the package's main entry, runtime.js fetches an opaque native binary from anonymous Cloudflare workers.dev subdomains oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-boxy-independent-bnpl-origination (npm)

Source: amazon-inspector 0512db79eba207153d2427271566e3ecd016d3d817266e683a801d82183254e9 On require, index.js loads ext.js which detects platform, constructs C2 hostnames by joining split string fragments e.g. "oob-worker.cf99-9b3.worker" + "s.dev", downloads an opaque binary from hardcoded...

Malicious code in devplatform-ui-kit (npm)

Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated .workers.dev hosts, with a DNS-TXT covert-channel fallback that...