flare-floss

Scripts de FLOSS FLOSS soporta la conversión de su salida en scripts para varias herramientas. Consulte los scripts de renderizado en este directorio. Adicionalmente, hay otro plugin para IDA para permitir que FLOSS extraiga automáticamente cadenas ofuscadas y las aplique al módulo actualmente...

MAL-2026-16070 Malicious code in @fyxzpediaa/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0747ec3c1ce519798cac2e89f8ec1e1532d428355a13929f0176a11d77a2b175 This fork of Baileys injects a covert remote-directed action into the WhatsApp socket. On every WebSocket connection, socketConnect reconstructs a UR...

MAL-2026-13953 Malicious code in js-assert-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acbf16a8956847ff7ed56158afe65bc0bf76cb36f8cb6af6bc143cae4cb9babe The npm package js-assert-plus masquerades as an assertion library homepage http://js-assert-plus.com and bundles the real chai source so consumers g...

Malicious code in sme-rko-finance-front-operations-tax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ede42a446ab3685943424af5a5411fb93bf5961c83ccf6ce02b35b8d835c60aa On require, index.js loads platform.js and lib/telemetry.js, which download a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in sme-rko-finance-front-payments-currency-payment-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20b5dcef9a8613b9de1b3bbd1137a65cdbf087a9a96543602fb3372d7eca978f On require of this package, index.js loads./loader.js which reconstructs C2 hostnames via array-join string concealment...

MAL-2026-13643 Malicious code in sme-rko-finance-front-operations-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd5c58bd9b678ac91c87dbb7f9a1d2318c67cd3754d643550c7674c903186de On require, this package loads ext.js and lib/telemetry.js which fetch a platform-specific opaque binary from a rotating list of attacker-controlled...

Malicious code in dolyame-ui-checkablegroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js...

MAL-2026-13596 Malicious code in dolyame-ui-progressline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e109a79a8ebbb2a7d21a37668b162bc92a5602ad24e7db6b6ce711f5cee152f6 On require, index.js loads shim.js which fetches a platform-specific binary from hardcoded Cloudflare Workers endpoints...

Malicious code in delivery-ci-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335 index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-inputfio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ac05c63a867647d4ec2bf3288918537aeadac4707342a70bfffd42cda60e9c On require of the package, adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments...

Malicious code in devplatform-spa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb27f42d7166d8e64db0a98a48a18f64817d801d1e4b6250c62320f08143d59 On require of the package, index.js unconditionally loads loader.js, which selects a platform-specific payload path, fetches an opaque native binary...

MAL-2026-13579 Malicious code in dolyame-ui-inputmoney (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4beb1232e4847e2167eb5709a0698e81199b3800c28f51b0cc47ba420ab02cad On require of the package, index.js loads support.js, which fetches a platform-specific binary from string-split Cloudflare Worker hostnames...

MAL-2026-13402 Malicious code in jagproject (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode... arrays that decode to https://fiora.nixel.my.id/...

MAL-2026-13237 Malicious code in bigops-products-accounts-and-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfef5ead75c58c24a4fc31b418af20b6252ac9177785002ccbf49407a28dddd8 On require of this package, index.js loads shim.js which selects a platform-specific binary, downloads it over HTTPS from string-split-obfuscated...

Malicious code in devplatform-spa-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428 On require, vendor.js selects a per-OS payload URL, fetches a binary from rotating .workers.dev hosts with a DNS-TXT base64 fallback via .dl.wel1.ru,...

MAL-2026-13262 Malicious code in devplatform-spa-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428 On require, vendor.js selects a per-OS payload URL, fetches a binary from rotating .workers.dev hosts with a DNS-TXT base64 fallback via .dl.wel1.ru,...

Malicious code in devplatform-test-pvm-is-odd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bea9b91a5e345be04b775870b684a468293d7d7e4a49fa31c21178cfcd02f68d [email protected] is a lure package whose index.js requires./bootstrap.js on load. bootstrap.js downloads a platform-specific binary...

Malicious code in dolyame-boxy-independent-bnpl-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1e1c76ea93bbc42ff9d45e1e876946d87d62dd9470683f34ffd312935b27802 On require of the package's main index.js, bridge.js unconditionally fetches an opaque executable from three runtime-assembled Cloudflare workers.dev...

Malicious code in dolyame-ui-clickable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f92051e4b21bd0bc9562833662ba7e1e9185bc8342bcc8bbbac8fc4d848c4dbe On require of the package, index.js unconditionally loads init.js, which selects a platform-specific endpoint linuxx64, linuxarm64, darwin, win32 and...

MAL-2026-13206 Malicious code in eacq-acq-menu-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daaba295870311c8170bc4ec82050e0f4ba2989be2b3e10de136647fc18ea6fc On require, index.js loads helpers.js which reconstructs C2 hostnames from split-string arrays e.g., 'oob-worker.cf.workers.dev' and 'sdk.dl.wel1.ru'...