Malicious code in dolyame-boxy-independent-bnpl-title (npm)

Source: amazon-inspector 955003be540a21f5e2fd1a7a5a5586276a5cc7f733c09d1f5412250fe0035f1b On require of the package, index.js loads setup.js, which selects a platform-specific path, fetches an opaque binary from a rotating pool of Cloudflare Workers subdomains oob-worker.cf99-9b3.workers.dev,...