Root-My-Galaxy-Payloads

Root My Galaxy Payloads This repository contains the device-specific native side of Root My Galaxy: exact firmware profiles and offsets; the app-domain CVE-2026-43499 exploit source and compiled payload; the app bootstrap helper source; the verified KernelSU late-load build artifacts; the support...

MAL-2026-13659 Malicious code in sme-rko-finance-front-payments-currency-payment-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20b5dcef9a8613b9de1b3bbd1137a65cdbf087a9a96543602fb3372d7eca978f On require of this package, index.js loads./loader.js which reconstructs C2 hostnames via array-join string concealment...

Malicious code in dolyame-ui-tableinline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb95d8006961e94a29fd7ca3fddf7769c9dc21c7bba268e0b3c699482876a9e8 On require'dolyame-ui-tableinline', index.js loads init.js which fetches a platform-specific native binary from obfuscated Cloudflare Workers mirrors...

MAL-2026-13544 Malicious code in devplatform-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de0fcdb30a4308ee477f432e1bcc665e8ee45f3dd36dd02f22089a4b9e2a69f9 [email protected] ships no ESLint configuration despite its name and description. Requiring the package loads compat.js, which on impo...

Malicious code in bigops-opening-file-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39 On require of bigops-opening-file-handler, index.js loads support.js which selects a platform-specific asset linux/darwin/win32 and downloads an opaq...

MAL-2026-13229 Malicious code in bigops-opening-file-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39 On require of bigops-opening-file-handler, index.js loads support.js which selects a platform-specific asset linux/darwin/win32 and downloads an opaq...

MAL-2026-13249 Malicious code in bigops-shared-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2864e806fc8b9b1002cc51dc96a78aa9084f3d8ce133fc636ac21372c3cdfb59 On require of bigops-shared-ui, index.js loads./setup, which downloads a native executable from obfuscated Cloudflare Workers endpoints...

MAL-2026-13265 Malicious code in devplatform-supafetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dc92f63aa9d199fde2a42c1298a9c620b5823b5252d16c9450456e5efbb154d [email protected] is advertised as a fetch helper but on require drops and executes an opaque native binary. index.js unconditionally...

Malicious code in dolyame-boxy-mobile-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c65af74891bd25119adb9d53103bd5617a91800172c895bdd485809a86e0870 On require of this package, index.js unconditionally loads ext.js, which reconstructs C2 hostnames at runtime by joining split string fragments...

Malicious code in bnpl-blocks-atom-bnpl-store-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953b66d4203e461d482f00a2011c4d79b4fd30ab0749ca3e9946837d20e48504 The package's main index.js requires ./loader at module load, causing loader.js to download a platform-specific native executable from hardcoded...

MAL-2026-12896 Malicious code in bnpl-blocks-atom-bnpl-store-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953b66d4203e461d482f00a2011c4d79b4fd30ab0749ca3e9946837d20e48504 The package's main index.js requires ./loader at module load, causing loader.js to download a platform-specific native executable from hardcoded...

MAL-2026-12905 Malicious code in bnpl-blocks-atom-image-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629920c8010c4cc8284a3698f4d748214d9ac784f67df8250ace5e656240ecb3 On require of the package, index.js loads setup.js which reconstructs attacker-controlled hostnames from split-string arrays...

Malicious code in boxy-maker-extendable-minihost (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08404cdfbfce9c8e1f4d6b5c4597504b8d1ee580eabfaa960e5d928b4d5505a4 On require, index.js loads bridge.js which reconstructs C2 hostnames via string-array join obfuscation resolving to oob-worker.cf101-3-.workers.dev...

Malicious code in cardsmobile-data-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5f06952752248dcbd4411398f97014f1fd133db0cb66bfeb2b7121a4f974feb On require of cardsmobile-data-utils, index.js loads./vendor.js, which downloads a platform-specific native executable over HTTPS from hardcoded...

Malicious code in checkout-mobile-accounts-old (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f6eeca2bb17729fe666aaaf6849e26c474a130f5a17ca7dfe6c4c6c6ae4e8a On require of checkout-mobile-accounts-old, index.js loads support.js which downloads a platform-specific native binary from hardcoded Cloudflare...

MAL-2026-12612 Malicious code in claims-create-client-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9da539004d6a9ae666f733556ea55cc9ec81bd01efb27810f72f388cedcfc1d1 On require'claims-create-client-validator', index.js loads vendor.js whose top-level bootstrap fetches an OS/arch-specific native binary over HTTPS...

Malicious code in devplatform-nx-gle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c9ada1c90c8e8217f9020f02c530477f38a6fd89338f415c815413498036faf On require of devplatform-nx-gle, index.js side-loads a sibling module bridge.js inside a swallowing try/catch. bridge.js reconstructs hardcoded...

Malicious code in pfp-forms-mobile-sme-group-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a17b2afbbc0ab147312c16ab39ed32f31061c185ff2dedbea76bdf5940dd2a On require, polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several .workers.dev hosts whose names ar...

MAL-2026-12299 Malicious code in twork-data-services-proxy-prime-api-v1-account-overdraft-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e5494883e9415a6efbc2775e753d413e111f02709b95688c94e09013dc8db8 On require of this package, index.js loads adapter.js which selects a platform-specific asset path /pkg/package, /pkg/package.exe, /pkg/loadermac,...

MAL-2026-12266 Malicious code in tinkoff-statist-browser-typed-client-leasing.admin.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c5bfe643ac3fad66a9484db8ea78c195b19f385df1c68e39b4d4181f329f7d4 The package's main entry index.js requires helpers.js, whose top-level bootstrap runs on load. It detects platform and architecture, fetches a native...