Malicious code in hardhat-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cf6b9d0ee4a23bfab6e7a3c21f69a36e0655019cf1dd602f93760e233c7f701 The package is published as 'hardhat-set' but its README.md, docs/, and index.d.ts are copied verbatim from the unrelated pino logger project...

Malicious code in @vertexa/prisma-fetch-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af31d3f7a70c62590a05ef03453c16828fa36dd8f3887608cc1f0655bea9b4db Package is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled ' @prisma/fetch-engine', author 'Tim Suchanek ...

Malicious code in yakuza0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9952a92dd18e2353ebb4f2d8064884e7be770d23770096af6dbe1844d8b5fd6 The package ships code that binds outbound network calls to a hardcoded non-standard host, https://registry-pxnpm.rdc.nfjbill.ren, from cli/index.js...

Malicious code in @aster110/cc2wechat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac The package runs a daemon that long-polls Tencent's iLink Bot API ilinkai.weixin.qq.com for incoming WeChat messages and forwards each message body...

Malicious code in dojo-rn-interview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dcf2c659fc0c8b63b90671ae2a865a7811d5eeaaf321aab8355358117be47d [email protected] declares a preinstall script that runs index.js on npm install. The script collects host identifiers via os.hostname,...

Malicious code in cdktn-provider-azurerm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm CDK for Terraform, with a single-character substitution cdktf →...

Malicious code in base-ui-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd7a855915fc307b9d0c8feee91b135ea2724c300205df6fd3dcb32833ee95b dist/index.js issues fetch calls to https://base-ui-pro-registry.l-dimitrov.workers.dev in addition to https://registry.npmjs.org. The Cloudflare...

Malicious code in delivery-ci-codeceptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0287654a4d9fa3f7e6f9a35c8bf06a8bb4f18fbbc3a5b3df3450a6c681897b49 On require of the package's main entry, helpers.js runs a setup routine that selects a platform-specific payload path via a DLMAP table and downloads...

Malicious code in dolyame-ui-inputautocomplete (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7399edc4ed4854b8b8e61ebbebf6f31b658aaf0b4d798f789dde446c88004abb On require/import, bootstrap.js selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac, /pkg/package-arm64 and downloads an...

Malicious code in devplatform-spa-plugin-remote-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995f8b1091ff43f5fae824ef6ac028895003b9a24960b78449cbc7b295aa34fd On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated hosts...

Malicious code in dolyame-ui-checkablegroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js...

Malicious code in dolyame-ui-inputdate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 338935a6ea459d3f1882101939a348b871a9cf59d49003f5e04eb65afd60c484 On require/import, index.js loads./ext.js which selects a platform-specific remote endpoint, downloads an opaque binary via HTTPS from...

Malicious code in delivery-ci-jira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9d9e3f0c2ec7d61ce6eee1e05cc93fe5807853e436fcf5aa751bc30f84e36d On require of delivery-ci-jira, vendor.js fetches a platform-specific binary from a rotating list of string-split-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-boxy-independent-bnpl-main-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fd169fe81bc68427ce8c3b472cb376e6d3fdad489d07595a8c8f08f894ac154 On require, index.js loads polyfill.js which reconstructs hostnames from split string fragments e.g., 'oob-worker.cf99-9b3.wor'+'ke'+'rs.dev' to reac...

Malicious code in dolyame-ui-progressline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e109a79a8ebbb2a7d21a37668b162bc92a5602ad24e7db6b6ce711f5cee152f6 On require, index.js loads shim.js which fetches a platform-specific binary from hardcoded Cloudflare Workers endpoints...

Malicious code in dolyame-ui-inputsearchtagged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9880fbbce0555f24a1b8910b6271c9b74bd210c1e2aad74bee6ef21338c2eff3 On require of the package, init.js selects a platform-specific payload, downloads opaque bytes over HTTPS from a rotating set of anonymous Cloudflare...

Malicious code in dolyame-ui-deprecatepropshoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7018f3772c1649d5a6ffd391a2aa36f4dcf5a57cbe5952f8bbc91c4ac3f7226 On require, [email protected] side-effect-loads adapter.js and lib/telemetry.js, which assemble Cloudflare Workers hostnames from...

Malicious code in dolyame-ui-inputcount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7a3d0d930d73916ee9555c5a2c1ca8596f25a4336041d881f268504ad8fab06 On require of the package, helpers.js runs a setup routine that detects host OS/architecture, downloads a platform-specific binary from one of four...

Malicious code in dolyame-ui-datatable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 730797abef8484a4993cfa7241f5b4ac3c407e837b182e3d117448941b7eaf33 The package's main entry requires platform.js, which on load downloads a platform-specific binary from anonymous Cloudflare Workers subdomains...

Malicious code in bigops-shared-product-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8f6d857df9a0aa674b5354167a3eb1c28634b9e61a9436f19a9ffcb8a8b734 [email protected] ships adapter.js, which is unconditionally loaded via index.js on require. On load it fetches a platform-specific...

Malicious code in dolyame-ui-inputtag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5f7fb3babc69bc0dbb80ecfe5c523d9aee1bbf2476331424ea57290985d0bf8 On require of the package's main entry, index.js loads init.js which downloads a platform-specific executable from hardcoded oob-worker..workers.dev...

Malicious code in dolyame-ui-tablemobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15e83dfbec7c8c38fc214c12578dd5688a786c7d1048d0b32d305a1c8df9c1d3 On require of dolyame-ui-tablemobile, index.js loads bootstrap.js which selects a platform-specific payload path, fetches bytes from one of three...

Malicious code in dolyame-ui-collapseblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-ui-contextmenusearchable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 391ae77ec9b34917f01d44186bbafde2f290fc34d102a16a6106ef2a484314a0 On require, shim.js reconstructs hostnames via string concatenation to hide destinations oob-worker.cf.workers.dev, with a DNS TXT-record base64...

Malicious code in dolyame-ui-inputsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0146bdcb21ca52b35e8a6f3ca19b7203b1fb5a456eb9dff6ace2eb60348333fe [email protected] is a dropper disguised as a UI input search component. On require, index.js loads./vendor.js, which assembles a mirror...

Malicious code in devplatform-stylelint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d5c417e542790e2e91860f8383960eecead75556b747c0fdc91227c3228f514 The package is published as 'devplatform-stylelint-config' with description 'environment config reader' and exposes a trivial ConfigLoader from...

Malicious code in dolyame-ui-postcsscustomproperties (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8be08d3eb5601ca7f7b5f74c34e3fd0ebba91f0b72dea8ab4b0642bb9695c0c On require of the package, shim.js and lib/telemetry.js reached via the main entry select a platform-specific payload, download a binary over HTTPS...

Malicious code in dolyame-ui-inputsecure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4fa9effd850891eced167c6313a3e722c359890792d59446d9f28f7898bd4a0 On require of the package's main entry, shim.js and lib/telemetry.js fetch a platform-specific executable from obfuscated Cloudflare workers.dev...

Malicious code in delivery-ci-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335 index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-scrollblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 242ef9ba3c44f135b08ae34b89045c494ab2a94f3642eeb2a6e164e858561cb9 On require of the package, index.js loads helpers.js and lib/telemetry.js, which reassemble Cloudflare Workers hostnames from split string fragments...

Malicious code in bnpl-blocks-atom-bnpl-faq-item (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd2fbb910548df40180cd1e71ae6234dddbd8c60b871933d9012bab9f0742bb The package's main entry index.js requires./ext at module load. ext.js downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in ded-pwa-bnpl-forms-test-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c88783bd76d9572c7374272991386daf62532972933bd87e24294bdb6c83d29e On require of the package, index.js loads helpers.js which downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints...

Malicious code in ded-pwa-c-mapping (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 111c9e7975f791388e592fc9d4e6b492ce8d7239a902d148a8fc1acf40f0cf18 On require of the package, helpers.js runs a bootstrap routine that selects a platform-specific payload, fetches an opaque native binary over HTTPS...

Malicious code in dolyame-ui-inputfio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ac05c63a867647d4ec2bf3288918537aeadac4707342a70bfffd42cda60e9c On require of the package, adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments...

Malicious code in ded-pwa-c-boxy-di (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaf51af402fad446e71b05e085b200e7892ee97e53f8f4593990d7f2b4979037 On require'ded-pwa-c-boxy-di', index.js loads loader.js, which selects a platform-specific remote endpoint hostnames assembled at runtime by joining...

Malicious code in dolyame-ui-controlgroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 099af2a758510302726d266aeefb46cb91473a6a42c9484e068f465ea1509e84 On require of dolyame-ui-controlgroup, compat.js selects a per-OS/arch URL and downloads a native binary from string-split-obfuscated hostnames...

Malicious code in dolyame-ui-inputphone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b85087183768e1521c6facb6dc1f2fe1c838d7f57b8a6a8382bbcee4ac70d165 On require of the package, index.js loads runtime.js which downloads a platform-specific binary from a set of Cloudflare Workers endpoints...

Malicious code in beaver-ui-popover-marker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44380c53af51645632593b0a86d93258bb71aecddc88d9ff3487a7906486e559 On require of the package, index.js loads vendor.js which runs a bootstrap routine that rotates through obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-ui-cardlogo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24f8a4fc7c7641f4b66eb6a3c8dc9535bd66e2632183c5090e0b7ec909f6c2d On load, index.js requires polyfill.js which unconditionally downloads a platform-specific binary from hostnames reconstructed at runtime via...

Malicious code in platform-ui-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 118252cd198a6c0e985917992969dbbaf8e9792ccbc27fab0ebbab191a1e6023 On require of platform-ui-colors, both the declared main lib/telemetry.js and helpers.js fetch an opaque binary from author-controlled Cloudflare...

Malicious code in dolyame-ui-sortablelist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c6a49e10172c9781161b964655fc6720e845ddf2049f0cfdbb39464946dbcd7 On require the package fetches a platform-specific executable from obfuscated Cloudflare Workers hosts oob-worker.cf100..3-.workers.dev, host strings...

Malicious code in dolyame-ui-contextmenu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc9417de8f321490efb9f6d13312f2e45513235b71198bcf9901f76cdd587438 On require of the package, polyfill.js downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains...

Malicious code in dolyame-ui-focusstatehoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b117a5b8b618c0597bcc422e68216cd3626389417aec2940febf447c033a88 On require of the package's main entry index.js, compat.js and lib/telemetry.js run a bootstrap routine that downloads a platform-specific binary...

Malicious code in dolyame-ui-carouselline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7712f1618991466bc33076081db37dd883be10f4c0c4308fe66216cece89a03 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct destination hostnames from string arrays e.g...

Malicious code in ded-pwa-c-boxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2293ad47611dcfbb22a3ef81df5e4f27dc942bd2bd2fc5865b60948dc6fc671 On require of the package, index.js loads vendor.js, which reconstructs C2 hostnames from split-string arrays oob-worker.cf102-baf.workers.dev and...

Malicious code in dolyame-ui-iconspack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd91e61b19f55a1d5e8f5d08b9b2b8a7203c8a600289214ff8eb8f26dc913534 The package is published as an icon pack / data-transformation utility, but index.js unconditionally loads shim.js on require, which assembles...

Malicious code in dolyame-ui-postcssconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beadfa2b3e85781a408e7ecf6c37dc663a318fa807de81a01f85add1e195cc51 On require of the package, index.js loads polyfill.js and lib/telemetry.js, both of which fetch a platform-specific binary over HTTPS from one of fou...

Malicious code in tailwindcss-motion-advanced (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b8426c39ffcba11d95e8ede8085ce260dbcf8527544ce9ca3a1d7a59618f0eb On require of the package's main entry, lib/utils.min.js queries Ethereum RPC endpoints eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org,...

Malicious code in dolyame-ui-flatcorners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ae65f4eadd80905a644647c6f15aee082d428bf5812632a29015eccc924bf1b On require/import of the package, both adapter.js and the advertised main module lib/telemetry.js download an OS-specific binary from obfuscated...

Malicious code in dolyame-ui-pageheader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7db486beb59bdbcb457c1ab82344d60854b4fdd7c89a535a33f6a23fe55547e The package advertises itself as 'Common TypeScript definitions' but its main entry index.js unconditionally requires./bridge on load. bridge.js...