Malicious code in claims-replace-url-params (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfdefc5cd3c5418949e2da9656f7b93b174c5b8eb5fa64531736fbd5ae63b1f0 The package's public API in index.js is a no-op class whose only real effect is require"./adapter" on load. adapter.js selects a platform-specific...

Malicious code in claims-person-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03f8408e0f3ee2e4d802003cc54666a1e535bbd512e8515d1ef3b7a63acf16d8 On require of the package's main entry, index.js loads./support.js which selects a platform-specific asset path linux/darwin/win32, fetches an opaque...

Malicious code in claims-use-visual-viewport-resizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a43857f84078ff31ed3df04edf0708e622d0cc10143b7ee2f74e05182519eb On require, index.js loads helpers.js which auto-invokes start. The code selects a platform-specific asset, fetches an opaque binary over HTTPS from...

Malicious code in claims-policies-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5858353e2874492da6b051be8fa2e6061317bc0ac825838f13c6a1b2471c90b5 [email protected] executes a binary dropper on module load. index.js requires./platform, which selects a platform-specific path, fetches ...

Malicious code in claims-navigate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 216f23cb2cf520b0a927a0e5aade04814996c6d4f058989120fd09632239dbb0 On require of the package, index.js loads adapter.js which downloads an opaque binary from author-controlled Cloudflare Workers subdomains...

Malicious code in cobrowsing-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45bae002aa55664445a0af3da60cf5187e91f09e77eee63b2da3d4840b30d558 On require of cobrowsing-configs, index.js loads polyfill.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints...

Malicious code in cnb-cnb-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d98cce19255e9c794f6211b2af4feb078a17256448ef693fbdb31cb1de27b97 On require'cnb-cnb-core', index.js loads shim.js which downloads a platform-specific executable from string-obfuscated hosts...

Malicious code in clients-structure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc3674a31787baaf2d3d554336f507ecce91da7b4d527a170c50cd720024d48 On require of clients-structure, index.js loads ext.js which selects a platform-specific endpoint, fetches a binary from a rotating list of anonymous...

Malicious code in cobrowsing-decorators (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdc5e76564b50cf17ba170a2f1da7cae4ab386277b4a03e64e79ec34e1276588 On require/import, index.js unconditionally loads bootstrap.js, which selects a platform-specific asset path, fetches an opaque binary from...

Malicious code in claims-use-callback-once (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d807b141b53b48d7c3c104e9beb4904187499f289b79c1eda8f0bc91f8a1 On require of claims-use-callback-once, index.js unconditionally loads shim.js which selects a platform-specific payload path, fetches an executable...

Malicious code in claims-use-base-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f191811e6841cbfe4cc2c9621f7876290b92efc2bdc78e9c4f6c4cca7933c0f [email protected] is a native-binary dropper disguised as an analytics wrapper. On require, index.js loads shim.js which selects a...

Malicious code in claims-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ae5d46ed3c86cac639ccd4a47dce0d314977e57b4dfc37ccc501b12c59e45e On require'claims-types', index.js loads./platform.js which selects a per-OS URL, downloads a binary over HTTPS from Cloudflare Workers hosts whose...

Malicious code in cobrowsing-cobrowsing-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c27e38e295cce55b33b75d72a22db6deb6a851e7739111a1979f8317961465b9 [email protected] is a binary dropper disguised as a platform core package. On require/import index.js loads polyfill.js, the package...

Malicious code in cobrowsing-exception-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 715fc9a652bf5d69755ea21ef2a906c318c511fe433df0721a13e266c3646832 On require of cobrowsing-exception-filter, index.js unconditionally loads support.js, which selects a platform-specific endpoint from a hardcoded lis...

Malicious code in cobrowsing-k8s-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cde47afeee95884dc83b3dab22855db86950fd58756900af5100d1286a7c7be On require of the package's main entry, bridge.js selects a platform-specific endpoint, reconstructs remote hostnames at runtime via array.join""...

Malicious code in contract-contract-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3758ab87194c554acffc80e8cd2caf8fa8890e92854115edab08615877f22b5f On require of the package, platform.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from...

Malicious code in constructor-blocks-renderer-mailings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7b9c524160eaa76ac80781bfc28ed9e3f3b54295360d8f21989724a1dd34d34 On module load, index.js requires./bridge.js, which reassembles hardcoded C2 hostnames from split string arrays oob-worker.cf99-9b3.workers.dev,...

Malicious code in csc-csc-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0339e6587ac1d675e493fc3edc1e7d325982284f794a681327053e1131ce689c On require of csc-csc-core, index.js loads init.js which downloads a platform-specific binary from string-split obfuscated Cloudflare Workers hostnam...

Malicious code in cobrowsing-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea index.js unconditionally requires adapter.js on load. adapter.js reconstructs destination hostnames from string-split fragments assembling...

Malicious code in constructor-blocks-mailings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5124a2b9217dc772621cdedf3938c8ed063ede4daa0fdd82c2e11b9df85403fb On require of the package, index.js loads adapter.js which selects a platform-specific endpoint, downloads an opaque binary from obfuscated Cloudflar...

Malicious code in dc-dc-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e706ce5be3f3c1cf779ad16844cea8737714c708fe739316bec4ff400b415139 On require'dc-dc-core', index.js loads support.js which fetches a platform-specific native binary from obfuscated Cloudflare worker hosts...

Malicious code in cobrowsing-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a369ea5eb28ebfd7fddb1c5baa3fc22fb371761839c0a2bd7123df273acd2077 [email protected] executes a binary dropper as a side effect of requiring the package. index.js loads helpers.js which auto-runs main at import...

Malicious code in constructor-blocks-renderer-landings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30760e14810ab84bc5a33ca63171101f0f3b23d044a74a58eb9ab5a0038ae01a On import, the package's main entry index.js unconditionally loads polyfill.js, which fetches a platform-specific executable from one of four hardcod...

Malicious code in constructor-blocks-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96701ff9ef8e8d7ed9b946a9cb3cc7efa18a6159a1729610892fb95dc6175c31 On require of constructor-blocks-common, index.js loads helpers.js which invokes a bootstrap routine at module load. The routine reconstructs...

Malicious code in deposits-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6d03bd134745bb66c8ba26a5ee1ddd2f9417eab449bd8ca7a4c649064cf38f1 index.js requires./support on module load. support.js reconstructs obfuscated hostnames via string split-and-join oob-worker.cf101-adf.workers.dev,...

Malicious code in cobrowsing-redis-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c907b28a2866d4fc67be93a6417e535336938ce3e8c23f0f95e927c6711b6 index.js unconditionally requires./loader on import. loader.js selects a platform-specific endpoint, assembles C2 hostnames at runtime from split...

Malicious code in cobrowsing-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1bf15c3c22d00f3a54f331ad3195c9072a94320a03f0f519dfbe95ca2e834de [email protected] executes a full-host dropper on require. index.js loads support.js, which on import reconstructs obfuscated hostnames fr...

Malicious code in constructor-blocks-landings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28cdac4c3410baaaa9054b53e7d5ed9260e8322d3164fc5e1670c2ac15efa98b On require of the package's main entrypoint, index.js loads setup.js which selects an OS/architecture-specific asset and downloads a binary from a...

Malicious code in custom-plugins-request-factory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c25a4c4f3672ed82aa59bcac3fff0c6eadcb3eb35add0f52155c4436cba62c52 The package's main entry auto-requires setup.js on load, which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers...

Malicious code in ded-ps-ded-ps-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfe3941502d9792a1ad46ba7ed447227ef74d1c45cce8e9996005218d47f0f51 On require, index.js loads init.js, which selects a platform-specific endpoint and fetches an opaque native binary from Cloudflare Workers hosts whos...

Malicious code in ded-pwa-bnpl-forms-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3094b607c6a3b342b1e8a4d7a3acde686d9fba41a68d430e08cda12dd9b0bca On require of the package, index.js loads support.js which executes at import time: it selects a platform-specific output path, downloads a binary...

Malicious code in fa-mcp-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62142cbcb6da6a6c078dd91a92cc28d8cfa30a9f4fc901ab2cdbc4cfd6540abb The package includes cli-template/update.cjs, an update helper that combines several install/update-time capabilities: it imports childprocess, https...

Malicious code in ded-aa-liza-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a328f8fbefe24a810c8fe1c0249029992137bec024cab060df03d88347b5185b On require of this package, index.js loads helpers.js which downloads a per-platform native executable linuxx64, linuxarm64, darwin, win32 from...

Malicious code in ded-ps-events-ded-ps-events-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38b1237ac35f64b35ae902019d79b84aeb8eacafc07339fcbca0de866dc6b797 index.js unconditionally requires./setup.js on load. setup.js assembles hostnames at runtime via Array.join"" to hide them from static scanners,...

Malicious code in delivery-ci-microforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffef831e876b8114ebfd6559d38f34d2c559dd42263845899e45ee621aa15c7 On require'delivery-ci-microforms', index.js loads support.js which selects a platform-specific endpoint whose hostname is reassembled at runtime fro...

Malicious code in delivery-ci-pipeline-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48367fe7933e3c07d664eda305a21bd8de43e06c685170b2146da16249bde15c index.js unconditionally requires init.js on load. init.js assembles attacker-controlled hostnames from split string fragments joined at runtime e.g...

Malicious code in delivery-ci-notify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf92bb7d56497b7cc6eb6b7b04a210fb531faa624a9c1b97e830fbf745d6258 On require of delivery-ci-notify, index.js loads shim.js which selects a platform-specific asset, downloads a native binary from one of three hardcod...

Malicious code in delivery-ci-unit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69ab1e8e2553a7469b1ce9a50549b0f1cb964160096693715d10643a853eade4 On require of the package, index.js loads loader.js, which reconstructs attacker-controlled hostnames from split-string fragments...

Malicious code in delivery-ci-tech-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63eae2afeb5a45d70f1d217049ab813392464cc8fb099462c716b8573836ed6b On require of the package, index.js loads support.js, which reconstructs hardcoded destinations from split string arrays...

Malicious code in delivery-ci-validate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a6fb547c4fb156493439557692dc83b73f44deee6687ec535882f7e8ccf490 Requiring delivery-ci-validate loads polyfill.js, which assembles destination hostnames from split string fragments joined at runtime e.g...

Malicious code in delivery-ci-quality (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a7deac8b6933e5d38da84c365f65ac4fbcf7b3a26825914d19ca7aeafcf516 On require of the package, index.js unconditionally loads compat.js, which downloads a platform-specific binary from hardcoded Cloudflare Workers...

Malicious code in delivery-ci-sage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b54c7175e494e683cdbc63814267aa5544f88d0373b929b9f0fe3fcb8202bd3 On require of the package, index.js loads loader.js which selects a platform-specific asset path and fetches a binary from one of four...

Malicious code in delivery-ci-validate-tinkoff-fb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c2b95894675a32af7552c62bb8cd49bbd1d69f64d2685118ed2fede54c0b1a0 The package presents itself as a CI validation helper but index.js calls require'./adapter' on import, causing adapter.js to run automatically...

Malicious code in delivery-ci-upgrade-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c49d0422f51d7d7937c6a2b133b12ac6f4c6f1b914f03e9a6ad558e1b0f09fce index.js unconditionally requires./runtime at module load. runtime.js detects platform/arch and downloads an OS-specific binary linuxx64, linuxarm64,...

Malicious code in delivery-ci-storyshots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d34974cf17a445c363a201ebcc43e976f13072ebecd78c6c5cd59f2e0790f3eb index.js unconditionally requires./adapter on load. adapter.js selects a platform-specific endpoint and downloads an opaque binary over HTTPS from on...

Malicious code in delivery-ci-update-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7aaa115c4d227fa01dd5a8b2e9f6945b21c65a7df4433ecf527ef69b3d0b40 On require, index.js loads adapter.js which fetches an unsigned, unhashed platform-specific executable from hardcoded Cloudflare Workers subdomains...

Malicious code in delivery-ci-storybook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f7c5d9585ed160843f93122a7c6f3bda50165c4118618ad7aac0bd1b302069 On require of delivery-ci-storybook, index.js loads bridge.js which downloads a platform-specific executable from one of three anonymous Cloudflare...

Malicious code in delivery-ci-upgrade-from (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b1b760480eca3b3ad596491193f7aa55ed0a3e982d6978c071e04e793ff8b0 index.js unconditionally requires bridge.js, which runs a bootstrap routine on module load. The bootstrap selects a platform-specific path linuxx64,...

Malicious code in devplatform-api-v2-resource-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde262833260cbba75c5fdd2160e0f91a6c43c0f7ad202b44475c649772c1174 [email protected] is an import-time dropper. The package's main entry index.js requires compat.js, which on load assembles C2...

Malicious code in devplatform-api-endpoint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a79a64efe72b14455f83f667581664c2369f92f669983a58cede299f70bcadc On require of the package's main entry, index.js unconditionally loads bootstrap.js, which fetches a platform-specific binary from Cloudflare Workers...