Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35c551dcbca891aad241e275845a629ffe436abba6b8efdde650d6c117108d45 On require of the package, index.js loads bootstrap.js which downloads a platform-specific native binary from Cloudflare Workers subdomains assembled...

MAL-2026-13657 Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35c551dcbca891aad241e275845a629ffe436abba6b8efdde650d6c117108d45 On require of the package, index.js loads bootstrap.js which downloads a platform-specific native binary from Cloudflare Workers subdomains assembled...

Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c602d22e5a0f1d7cee18a98a7ce0b67e2c8440f7ff95330cb6c33d169f2e629 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct the identifier 'childprocess' and destination...

MAL-2026-13658 Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c602d22e5a0f1d7cee18a98a7ce0b67e2c8440f7ff95330cb6c33d169f2e629 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct the identifier 'childprocess' and destination...

MAL-2026-13654 Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d957fec8c08e1dcadbcd6e4b6933a1c1482356e79adbfe1f6ceb6d64a68855f On require of the package, bootstrap.js selects a platform-specific path from a hardcoded map, downloads an opaque binary from one of three Cloudflar...

Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d957fec8c08e1dcadbcd6e4b6933a1c1482356e79adbfe1f6ceb6d64a68855f On require of the package, bootstrap.js selects a platform-specific path from a hardcoded map, downloads an opaque binary from one of three Cloudflar...

Malicious code in sme-rko-finance-front-operations-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26817ccf57c03ae447f3181ec0a18c3cf5a2bcd09da40cd8aaa3fa56446ab21 On require/import, index.js loads./bootstrap and re-exports./lib/telemetry, both of which execute a download-and-execute dropper. bootstrap.js...

MAL-2026-13643 Malicious code in sme-rko-finance-front-operations-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd5c58bd9b678ac91c87dbb7f9a1d2318c67cd3754d643550c7674c903186de On require, this package loads ext.js and lib/telemetry.js which fetch a platform-specific opaque binary from a rotating list of attacker-controlled...

Malicious code in sme-rko-finance-front-payment-registers-operations-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b21f700cd5e3a5eb33a34fa9e3a9754e73e5794ee1cc57ada01344004a8c921 index.js unconditionally loads runtime.js on require. runtime.js detects the host OS and architecture, then downloads an opaque platform-matched bina...

MAL-2026-13653 Malicious code in sme-rko-finance-front-payment-registers-operations-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b21f700cd5e3a5eb33a34fa9e3a9754e73e5794ee1cc57ada01344004a8c921 index.js unconditionally loads runtime.js on require. runtime.js detects the host OS and architecture, then downloads an opaque platform-matched bina...

Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b691054dd402370143740f95ea751e6f5c7caa51753e91ccc11fadabca90e637 On require, index.js loads bridge.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads bytes from a rotatin...

Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4554e1a911548ca2145464d06bcd3c66d69c9fb307a1df557924fb89b3e8c7fd On require of the package, index.js loads bootstrap.js which selects a payload path based on process.platform/arch linuxx64, linuxarm64, darwin, win3...

MAL-2026-13655 Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4554e1a911548ca2145464d06bcd3c66d69c9fb307a1df557924fb89b3e8c7fd On require of the package, index.js loads bootstrap.js which selects a payload path based on process.platform/arch linuxx64, linuxarm64, darwin, win3...

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but...

Malicious code in dolyame-ui-popupcarousel (npm)

Source: amazon-inspector 2d354604a4226c4f6847ce621402caf3b48115d1cbbaa52916d547f1337c38f6 On require of the package, support.js and lib/telemetry.js each fetch a platform-specific native binary from rotating anonymous Cloudflare Workers hosts oob-worker.cf100-3-.workers.dev with a DNS-TXT base64...

Malicious code in dolyame-boxy-independent-bnpl-faq (npm)

Source: amazon-inspector cf17b5bab6439a518226a8e3caf758974a9dd8846e587347ea33356c5f780a53 On require of the package, index.js loads runtime.js which selects a platform-specific binary path, downloads an opaque payload from string-array-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-ui-generateid (npm)

Source: amazon-inspector 1db498e928fa247c2f3efbee2eaea516e60b450483e29d3537bac04061cbffdf On require of the package, index.js loads shim.js which selects a platform-specific payload URL by concatenating string fragments to reconstruct hostnames oob-worker.cf103-070.workers.dev,...

Malicious code in dolyame-boxy-independent-bnpl-main-title (npm)

Source: amazon-inspector 7fd169fe81bc68427ce8c3b472cb376e6d3fdad489d07595a8c8f08f894ac154 On require, index.js loads polyfill.js which reconstructs hostnames from split string fragments e.g., 'oob-worker.cf99-9b3.wor'+'ke'+'rs.dev' to reach multiple Cloudflare Workers subdomains, downloads an...

Malicious code in dolyame-ui-collapseblock (npm)

Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-ui-clickoutsidehoc (npm)

Source: amazon-inspector f51c89bb293b46f81970bb75e1d39616abb2244683d83bbc03dcd60f7f5e4e57 On require of this package, index.js loads shim.js which assembles hostnames from split string fragments to hide them e.g. "oob-work","er.cf100-416.workers",".dev".join"" and 'sd','k.dl.wel1.r','u'.join"",...