Malicious code in sme-rko-finance-front-operations-fee (npm)

Source: amazon-inspector 6a2ef64871ebe6bf7dd675b3e686beec5a90dbaec72760b647e3c876674df9c5 The package's main entry ./lib/telemetry and its vendor.js module execute a binary dropper at require/import time. Hostnames and API identifiers are reconstructed from split-string arrays to evade static...

Malicious code in dolyame-ui-tabsblock (npm)

Source: amazon-inspector 7b1de03bd78472fa85163160c48af5b0ef0dd14fd1b49bc60e66a3ef10bb8ef2 On require, index.js loads./compat and./lib/telemetry, both of which reconstruct hostnames at runtime from string fragments e.g. "oob-worker.c","f102-baf",".wor","kers",".dev".join"" and fetch an opaque...