Malicious code in @galicia-toolkit-nestjs-20/archetype (npm)

Source: amazon-inspector 662603823964bdbc871f386498e949d768c84d99645690ee3b5e904b458536db On module load, index.js unconditionally requires a bundled native binary at prebuilds/-/metrics.node inside a try/catch that swallows errors. The ELF reads installer-side credential-grade environment...

Malicious code in pxnpm (npm)

pxnpm 7.0.0-beta.6, 7.0.0-beta.8 and 7.0.0 published 2026-10-06 by user nfjbill are a 10-file, 16 KB launcher for a native executable that is not contained in the package. The postinstall script bin/install.cjs calls ensureNative in dist/download.cjs, which downloads a 17-21 MB Brotli archive for...

MAL-2026-17725 Malicious code in @galicia-toolkit-nestjs-20/archetype (npm)

@galicia-toolkit-nestjs-20/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon th...

Malicious code in @galicia-toolkit-nestjs-20/archetype (npm)

@galicia-toolkit-nestjs-20/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon th...

Malicious code in dolyame-ui-stepper (npm)

Source: amazon-inspector 25a9668418d3b01588efbd1a9385ae05b720cf72761700fe815d10d3d0e834b3 On require'dolyame-ui-stepper', index.js unconditionally loads shim.js, which assembles hostnames from split string fragments resolving to oob-worker.cf101-adf,99-9b3,100-416,103-070.workers.dev, with a...

Malicious code in dolyame-ui-mixins (npm)

Source: amazon-inspector c202a6c0c4fddf77f53b3fc786c34627b47992e1f789701121793399dce47ebd On require of dolyame-ui-mixins, index.js loads./ext, which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32 and downloads an opaque native binary over HTTPS from one of three...

Malicious code in dolyame-ui-layout (npm)

Source: amazon-inspector 8f8bf970c387898705de052ea5736f3f90877cfcdad204af1a772b5230c95c31 On every require of dolyame-ui-layout, index.js loads platform.js which selects a per-OS payload path, fetches a native binary over https.get from Cloudflare Workers hosts whose names are assembled at runtim...

Malicious code in dolyame-ui-label (npm)

Source: amazon-inspector bdcede6d4d42bfed7f10577346b24e9af22655e50f8d454baab6f4999e6020f3 dolyame-ui-label 35.7.8 is not a UI component library. On require of the package, index.js loads helpers.js, which reconstructs C2 hostnames at runtime from split-string arrays e.g...

Malicious code in dolyame-ui-notification (npm)

Source: amazon-inspector 27d450fda6c199002bb4eb20b3bf624e31393ae3ed30e9a36fce17507472b962 Package advertises itself as a UI notification toolkit but its main entry requires./compat.js, which on load randomly selects a destination from four obfuscated Cloudflare workers.dev hosts...

Malicious code in dolyame-ui-loader (npm)

Source: amazon-inspector 38e3316d577d11997d6d21e26dc346cf8f3cdb986d4e61d7ac95dac0c3eda7ba On require'dolyame-ui-loader', index.js triggers shim.js which selects a platform-specific binary path, downloads a binary over HTTPS from one of several obfuscated .workers.dev hosts reassembled at runtime...

Malicious code in dolyame-ui-flag (npm)

Source: amazon-inspector be48c86f2b67912c3cfa1849431e5eb3d45510c55bb1fa98ab304dc36d25097b On require of the package, index.js loads vendor.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev hosts oob-worker.cf101,2,3-.workers.dev with a DNS-TXT chunked base64...

Malicious code in dolyame-ui-confirmation (npm)

Source: amazon-inspector dba60f94522cc371a13cce00e6a8e51678812f3f50f3e577fd5e9275295a72e0 [email protected] ships a shim.js that is required from index.js at module load. On import, shim.js detects the host OS/architecture, downloads a native binary from one of three Cloudflare Worke...

Malicious code in dolyame-ui-clickable (npm)

Source: amazon-inspector f92051e4b21bd0bc9562833662ba7e1e9185bc8342bcc8bbbac8fc4d848c4dbe On require of the package, index.js unconditionally loads init.js, which selects a platform-specific endpoint linuxx64, linuxarm64, darwin, win32 and downloads a native binary from a rotating list of anonymo...

Malicious code in dolyame-ui-badge (npm)

Source: amazon-inspector 11c1280f596630bc692c2587a15a33bd01b2b745875cfe8a590e6787757867dd On require of dolyame-ui-badge, the package loads bootstrap.js which downloads a native binary from runtime-assembled Cloudflare Workers hosts oob-worker.cf101,2,3-.workers.dev with a DNS TXT-record fallback...

Malicious code in dolyame-ui-carousel (npm)

Source: amazon-inspector 99a12afad0ec2643334f24431df3b2ba84584a9569bca025b50ef52feb6b9493 On require of the package's main entry, shim.js selects a platform-specific payload path and downloads a native binary from one of three Cloudflare Workers hosts whose names are assembled by string-array joi...

Malicious code in devplatform-spa-di (npm)

Source: amazon-inspector 0b547ced93ce179bd009fd7e88e23e19ba63fdb224d9b32c62588f05a3fd40f5 On require'devplatform-spa-di', index.js loads polyfill.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev, cf99-9b3.workers.dev,...

Malicious code in devplatform-s3-uploader (npm)

Source: amazon-inspector 202bd53eb339cdbd72320893af375903622c29dc8f55c54c6dc9ae94d2e727b9 On require of the package, index.js loads helpers.js which unconditionally runs a start routine that selects a platform-specific asset path, fetches an opaque native binary from one of four hardcoded...

Malicious code in devplatform-spa-plugin-sentry (npm)

Source: amazon-inspector e2827eaf1f2c14fe16fc0fcab1ad65266f275fb22a9a81237d93f8e93e84894f On require, index.js loads helpers.js which fetches an OS/arch-specific native binary from obfuscated Cloudflare Workers subdomains oob-worker.cf9-9b3.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in devplatform-spa-plugin-auth (npm)

Source: amazon-inspector 697c6ca9c6aa1474e725b8f1c7d64c0b1809131ce1c8a856253db8d480791ff0 The package's main entry loads helpers.js which auto-invokes a start routine on require. That routine selects a platform-specific asset path, retrieves an opaque native binary over HTTPS from one of four...

Malicious code in devplatform-snarkdown (npm)

Source: amazon-inspector 050140bdd00f1d32d6a6142067c28c92fe95ff1be979f4272c8966ba58c78b92 On require of the package, shim.js selects a platform-specific URL, downloads a binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev,...