Malicious code in bnpl-blocks-desktop-bnpl-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4909f4a2b9f9355cd2cbde2b75f8a5d7d3f4ec6b79ed828fdb9cc18b23107e0 On require of the package, index.js loads./setup, which selects a platform-specific URL, fetches an opaque binary from string-concatenated Cloudflare...

Malicious code in scrollbar-hide-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f19e1731b591552a096b108703702b9663c1bbb8cf9c2ff6fc048f8582e8607 The package's main entry dist/index.js appends an obfuscated payload — wrapped in evalatob... with require targets and URLs hidden in \uXXXX escapes ...

Malicious code in aasp-tent-aasp-tent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f40a1f6a1ee90eed076db7cd24155d8dd0ceb6f3bd3b0698eb9ff0b0543efee On require of the package, index.js loads compat.js, which detects the host OS/arch and fetches a per-platform native binary from author-controlled...

Malicious code in trapp-check-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fea7c6987689190a5c45008fc1bfbf14ae177c63630b38ced1190e0c5c3d7661 On require of the package, index.js loads bridge.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

Malicious code in cors-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c243bfa0251c11e10ceee74a90cffa2189086cf647ad8dfe6d70ab5e3491a5 Package impersonates the widely-used cors Express middleware. lib/index.js copies the legitimate expressjs/cors source but adds an exported getPlugin...

Malicious code in datefmt-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector addca973f3384757b9ff2e00e5becd70e509ef5233c4cd2dc6ce73019b467787 datefmt-pro presents itself as a date formatting utility, but its actual behavior is an install-time reconnaissance beacon. The scripts.postinstall...

Malicious code in vvvedernikov-test-another-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69575654ed937cf00fb8e19691a12f08f966639ceec4ddc306d65a5af0ab8f83 On require of the package, index.js loads bootstrap.js which selects a platform/arch-specific asset path, fetches opaque bytes over HTTPS from one of...

Malicious code in statist-browser-typed-client-investing.product.loginandauthorization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 508b23be5504ec69bf284c9a99bb7840e284c52862e07588b07807ebc4f0d71c index.js unconditionally requires./bridge on load. bridge.js selects a per-OS binary URL from a list of string-split-concealed hosts...

Malicious code in json-validator-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf The package advertises itself as a JSON/XML validator but lib/core.js contains a multi-stage dropper triggered on any call to the public API...

Malicious code in tramvai-module-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8841208443b6595c8389bfac3e1cdb59a65ad0bc05a8dd3e01ca5c661287e56 On require of the package, index.js loads setup.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in twork-data-services-procedure-engine-api-v1-procedure-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421a0316130197eb768ed2dbdf50c031f5ac8f79c3a58994369257ba70cff036 On require of the package's main index.js, support.js reconstructs attacker-controlled hostnames from string-split arrays...

Malicious code in fb-cards-form-no-resident-information (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f5f533e1e08aafbda3bd64998ad984e90345592ecc1a9fd14f6d449413e6c87 On require of the package, index.js loads adapter.js which reconstructs Cloudflare Workers hostnames from split string fragments e.g. 'oob-worker' +...

Malicious code in accounts-stores (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c70d8323b295e6b8dfa18e720a7b6e2a719c42d19a5dedab1157866043417c7d The package advertises itself as a reactive state-management library but its index.js silently requires./setup at the end of module load inside a...

Malicious code in react-scroll-disable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e2eae248242fe92d777348542534e187d7773c2a092e8d3240d8bdd5b94afa On require of react-scroll-disable, the package's main entry executes an evalatob... blob appended after the legitimate RemoveScroll export. The blob...

Malicious code in accounts-offers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b8f0ec540c47830dcdf624b91e67aa00b005c240e43bb7cd5ffd183f02beac7 The package advertises itself as an 'Accounts offers library' but on require index.js silently loads setup.js, which via process.nextTick collects...

Malicious code in accounts-appointment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b85924ae1e24ede2acf333de8af5ca1d8ae2854652be2b3b82a01df710adc27a index.js unconditionally requires./setup, which on load selects a platform-specific payload path, fetches bytes over HTTPS from Cloudflare workers.de...

Malicious code in accounts-card-design-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bdaa2c933125ad6b8c88277ca7b778654f4a73bf7d6b1c9e945a4e9a2a80eed On require of the package's main, index.js loads platform.js, which fetches a platform-specific native binary from Cloudflare Workers hosts assembled...

Malicious code in accounts-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b71ef624b0206201b243cfed88cdfc36804bbfd903f60cb7c9da9cfa64b4b2a7 On require of the package, index.js loads helpers.js, which selects a platform-specific endpoint from a list of Cloudflare Workers hosts assembled by...

Malicious code in accounts-ddos-shield (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 343cd6e6bdb885bf8fe4d59b376a32c5ab57f309707c4253b2bf7307d631be79 On require of the package, helpers.js selects a platform-specific payload path and downloads an opaque binary from one of several Cloudflare Workers...

Malicious code in accounts-limits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69c43a5fbac213b36e4a3d7c25d7f41311e6f3f111f3b175e2f306077afbcde0 index.js unconditionally requires./runtime.js, which on module load selects a per-platform asset path, fetches an opaque binary from one of three...

Malicious code in tailwind-animation-founder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 212392bc085368a2f4227f1cba627c6dd4629855bb5f3aa3529931d35f13ed21 The package publishes as 'tailwind-animation-founder' while its README, homepage, and npm badges point to a differently-named upstream...

Malicious code in accounts-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f17174f805fda0f57e8b471b2a788e92836a2c20d5da22e818ed43218503b0ed On require of accounts-forms, index.js loads polyfill.js which selects a platform-specific URL and downloads an opaque binary over HTTPS from hardcod...

Malicious code in tailwindcss-form-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae9425c630e8b36b03993f6124066f178a86a285ae44e5e4590016ac575c4cac index.js exposes getPlugin, which performs an HTTP GET to http://46.183.25.232:45000/icons/106, parses the JSON response, and passes the credits fiel...

Malicious code in tailwind-opentype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb5a3e0b9f27817cc8e965ed397d0ec2a01b2e13f26051ee6c0e884fa5008beb dist/index.js re-exports a benign Tailwind plugin and appends an evalatob... payload that runs when the module is required e.g. from a project's...

Malicious code in tailwind-custom-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a94fe37df5952bc2326d9f0a759cf89d7105f47790fc71dc4731d87ec67a7f2 The package impersonates @tailwindcss/forms: package.json declares the name tailwind-custom-forms while the repository field points at...

Malicious code in tailwind-animationpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63abd5591507bb96b45cdf17209563ccfe52015a0bb8c5258bf3ea8cdc034fb3 src/index.js appends an obfuscated evalatob... block after a legitimate-looking Tailwind plugin export. The decoded loader hides module names and...

Malicious code in tailwind-animationgroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa7ac62a4a5dbe9acfdc813215213c698a79588f96614191505e41bf116c9c66 src/index.js appends an evalatob... blob after the tailwind plugin export. On any require/import of the package, the decoded loader queries Ethereum...

Malicious code in fb-insurance--boxified-form-vzr-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1527da37d48efd3c216bf62d4f3d167181948006ad5d8e88f2ff9fa40eb0875 On require of the package, index.js loads loader.js which selects a platform-specific endpoint, fetches an executable payload over HTTPS from hardcod...

Malicious code in 1239i32049i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c99f6d077df7b1209fb59dafa8641b14b3947d321379bc6ad22f2660d3d4c7b Package declares a postinstall script that runs dist/index.js, the sole shipped file, which is heavily obfuscated with javascript-obfuscator rotated...

Malicious code in tailwind-animate-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eb20d422c7053793a78e3d898bef2d97269318be88f147d60c7d036d2d23144 index.js appends a large base64-encoded, unicode-escaped payload after 11 KB of whitespace padding, executed via evalatob'...' whenever the package i...

Malicious code in tinkoff-fb-fieldset-car-reference-kasko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba1a3309e85c6e4e6f80764a7874fe3ba7c1abf63a760eab670fc81a0700249 On module load, index.js requires./shim.js, which immediately runs a dropper: it fetches an opaque platform-specific binary from hardcoded Cloudflare...

Malicious code in tinkoff-statist-browser-typed-client-jumptaxi.feature.contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c49c7504b3756df1b52427ccdf475385aad6d95ca04add8cd5eb343e5f970f The package's index.js unconditionally requires vendor.js on load, which runs a bootstrap routine that fetches a platform-specific binary over HTTPS...

Malicious code in tinkoff-boxy-mobile-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0975c5e634ca65495f0ec35088db60ae98702849f5f2fb31e2ad1d8eee2068b7 On require of the package, index.js loads./platform.js, which selects a per-platform payload path, fetches an unsigned binary over HTTPS from...

Malicious code in tinkoff-boxy-independent-kasko-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 873f98d16d6e9c4ecb2f5919621cfa940fe0059c48de29b1bb0eff6420527afc On require of the package, index.js loads bootstrap.js which reconstructs hardcoded hostnames via split-string.join obfuscation and downloads a...

Malicious code in tinkoff-boxy-gitlab-labels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995279b7bea8c6d826ee620cb5a31dc38662a1ba4d4b07bda9fc941908daa1e3 On require of the package, index.js loads runtime.js which selects a platform-specific payload path, fetches an opaque native binary from...

Malicious code in tinkoff-statist-browser-typed-client-leasing.admin.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c5bfe643ac3fad66a9484db8ea78c195b19f385df1c68e39b4d4181f329f7d4 The package's main entry index.js requires helpers.js, whose top-level bootstrap runs on load. It detects platform and architecture, fetches a native...

Malicious code in tinkoff-pwa-confac-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdebc9c281924002edabc3f53a796ac4a5a5e78d64fbb70974b2c3597de7f84d The package advertises itself as a types interface but its main entry silently requires adapter.js inside a try/catch. On require, adapter.js assembl...

Malicious code in tinkoff-fb-app-frame-page-height-dippy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db9a5313417dcbe6f8514736de7dd82892ad5cdccc261e0064d8f76f8d9613e On require, index.js loads platform.js, which reconstructs C2 hostnames via runtime string concatenation joining fragments such as...

Malicious code in tinkoff-statist-browser-typed-client-eventea.projects.finhealthwebmicroblocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d381f80d9b2d3b310ab426d3c51996861b4c320f2926e53ea078da80e832a07 On require of this package, index.js loads vendor.js which downloads a platform-specific binary from runtime-assembled Cloudflare Workers hostnames...

Malicious code in tinkoff-fb-service-prefill-profile-contact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d549ceada3b5ffb1d4affe80caa58597b04df716893d876f88193c1c7a81317f On require of the package's main entry, vendor.js downloads a platform-specific executable from anonymous Cloudflare Workers hosts under...

Malicious code in tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc7dae6b0c575dcb758eec30a647592471c39ded904ff4ed379cadd93b4f6cf4 index.js requires./polyfill on load, which selects a platform-specific endpoint, fetches an opaque binary from runtime-assembled Cloudflare Workers...

Malicious code in tinkoff-statist-browser-typed-client-coretech.statist.mobile.ci (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d1b853fe0164696ce54aa2550929d727c9ea06d42925934efacf57aeae3ff7 On require of the package, index.js loads loader.js which downloads a platform-specific executable from Cloudflare Workers endpoints assembled from...

Malicious code in tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba0f8f5362c28a3be51253f23b5bd737f0232d9563d1adcbfb3c891f8ed56dd0 Package main entry require's./adapter on load, which reconstructs Cloudflare workers.dev hostnames and a well1.site fallback domain via split-string...

Malicious code in tinkoff-statist-browser-typed-client-sme.platform.web.companyprofile.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189b38f890bbf70f19838f7da330c3bf2798028f8cdc600bc58b5e38419e7795 On require of index.js the package loads vendor.js, which selects a platform-specific payload linux/darwin/win32, downloads it over HTTPS from...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.authorization.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 698cb702f4e52ddb67226e8681dc3a11228f43cd11b47516329e16b8ae3de436 The package typosquats an internal Tinkoff scope name. On require, index.js loads init.js, which builds attacker hostnames at runtime from...

Malicious code in tinkoff-statist-browser-typed-client-art.apps.reporegistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1 On require of the package, adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardcoded Cloudflare Workers host...

Malicious code in tinkoff-volna-zustate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01865b8f060a3e4a24f34537d14ace960460519b2e5e3073083c7de9da63bd9e On require'tinkoff-volna-zustate', index.js loads bridge.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in tinkoff-statist-web-typed-client-test.golden.retriever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 352e7120bec31271d79af9befe17a46024f5785ffca010335fa13eb40c946e3a On require of the package, index.js loads init.js which reconstructs attacker-controlled hostnames via array-join string obfuscation four...

Malicious code in tinkoff-boxy-desktop-mgm-product-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5a7c457a57706b708f2b1e45df0c9746088cbdbb9eaacc598536017272a547 The package's index.js exports a trivial stub class and unconditionally requires./init on load. init.js reconstructs network destinations at runtime ...

Malicious code in tinkoff-statist-browser-typed-client-mb.product.tgeofencing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 471fb9b5c8d45abc59ffda97063561b4882d28109c9959c717fbcd0d9f25c00d On require of this package, index.js loads platform.js which assembles remote hostnames at runtime by concatenating fragmented string arrays to hide...