Malicious code in bigops-shared-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2864e806fc8b9b1002cc51dc96a78aa9084f3d8ce133fc636ac21372c3cdfb59 On require of bigops-shared-ui, index.js loads./setup, which downloads a native executable from obfuscated Cloudflare Workers endpoints...

Malicious code in bigops-storio-ngrx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6eb386f3b0d35ecf71762d0e719f883a3e1e207a2a3a9e1f52e7729de7753ae0 On require, index.js loads./ext.js which selects a per-OS asset path and downloads a binary payload from one of three runtime-assembled Cloudflare...

Malicious code in docker-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f02e61d324161238593fb7e59dc907f183bf885a908354fed1eba0662906947b [email protected] is a typosquat of dockerode. On require, index.js collects hostname, username, homedir, platform, cwd, and the entire...

Malicious code in @zzzcrypto/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ceac45508e2f9506a082b2195d3bae4b046f096d11856d72ea53f784ad5992e @zzzcrypto/[email protected] is a typosquat/impersonation of @solana/spl-token README self-describes as a 'drop-in replacement'; author metadata...

Malicious code in @zzzcrypto/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781049b09ea0edc63ede63c8c559e3e9a08255982bbe6d18c2e4c0823b4fdf0c Package impersonates the legitimate xrpl library README: 'Drop-in replacement for xrpl'; author field 'XRPLF'; repo points to a non-existent...

Malicious code in @zzzcrypto/playwrite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c297b354235cda442a2ca4057884b85f1e29a920c6dcae318ab8149770ad80d0 On require of @zzzcrypto/playwrite, index.js harvests the installer's full process.env plus hostname, username, homedir, platform, cwd, and package...

Malicious code in @zzzcrypto/bitcoin-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9d633d3efb27db376be57d77ebbd808db458d088503adebe2f7ad7501281dd1 On require, index.js serializes process.env together with hostname, username, homedir, platform, cwd, and a timestamp, base64-encodes the JSON, and...

Malicious code in @zzzcrypto/etherjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2aebef684ec4affb6c5d0504179ef4e4f409bf6680cdd6d70772ec8f9b3bf35 @zzzcrypto/etherjs is a typosquat of the popular 'ethers' package. On require, index.js collects the full process.env object along with hostname,...

Malicious code in devplatform-test-pvm-is-even (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab114c230ec1d462306a74f0eaaddf32474b1fae0087e1038ab2e280637d558 The main entry index.js requires./runtime.js, which at load time assembles hostnames from split string arrays e.g. 'oob-worker.cf101-adf.workers.dev'...

Malicious code in aws-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3753967ef5752d68dd0880c092d77ab42bb18fe5e081c258961572581cb81aa7 Package aws-sdk-v4 impersonates @aws-sdk/client-s3 and, on require of index.js, JSON-stringifies process.env together with hostname, username, home...

Malicious code in devplatform-spa-use-track (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59ba2c5091a95bcff203618393da399071dba1859bb0af79ca39021b7a1bdb5f On require of the package, index.js loads polyfill.js which fetches a platform-specific binary from one of four Cloudflare Workers hosts...

Malicious code in devplatform-spa-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428 On require, vendor.js selects a per-OS payload URL, fetches a binary from rotating .workers.dev hosts with a DNS-TXT base64 fallback via .dl.wel1.ru,...

Malicious code in devplatform-spa-plugin-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca84ec076b60ced1412d45476eb90fb5c797b8dd53a5151d474dc979a085565 [email protected] is a binary dropper. index.js unconditionally requires shim.js, whose top-level init fetches a platform-specific...

Malicious code in devplatform-supafetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dc92f63aa9d199fde2a42c1298a9c620b5823b5252d16c9450456e5efbb154d [email protected] is advertised as a fetch helper but on require drops and executes an opaque native binary. index.js unconditionally...

Malicious code in devplatform-vite-plugin-gle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81ba08fb4c9c52336f51b45ebe9089ba0b441f3da79529ac1c56f146d71861b6 On require, support.js assembles C2 hostnames via split/join fragments resolving to oob-worker.cf100-416.workers.dev, cf103-070.workers.dev,...

Malicious code in devplatform-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0244bc7396ea5f52d909130a7d685fee98c0dda29cb18b82d17e8c9c90dff552 [email protected] ships an index.js whose main module requires bootstrap.js, which on load downloads a platform-specific binary payload from...

Malicious code in devplatform-test-pvm-is-odd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bea9b91a5e345be04b775870b684a468293d7d7e4a49fa31c21178cfcd02f68d [email protected] is a lure package whose index.js requires./bootstrap.js on load. bootstrap.js downloads a platform-specific binary...

Malicious code in devplatform-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated...

Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

Malicious code in devplatform-ui-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74230ed898152bc75d702938fcac9bd53e13ff7100120b44c5944bb8226225f7 index.js unconditionally requires./compat on load, which selects a platform-specific asset path linux/darwin/win32 and downloads bytes over HTTPS fro...

Malicious code in devplatform-vite-plugin-preserve-css-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0781a29416d218a9767f37894e3ad9a851110f50693a4bcb1ab6bd168e1f6feb On require of the package, index.js loads loader.js which selects a platform-specific endpoint, downloads a native binary over HTTPS from...

Malicious code in dolyame-boxy-atom-bnpl-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ecc1e21adbb7890afdc37d9e00e09d56b9b66fc9793603884569d8beed29d7 On require of dolyame-boxy-atom-bnpl-badge, helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors...

Malicious code in docsmate-docsmate-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev and siblings cf100-416, cf101-adf,...

Malicious code in dippy-invertor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8dbed78de451c63784d37e7ae925bc4bf1288b7c4cf6e0e6fb0e7f9ff4cd451 On require'dippy-invertor', index.js unconditionally loads ext.js, which downloads an OS-specific executable from four hardcoded Cloudflare Workers...

Malicious code in devplatform-zod-wip-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2629721fa3107222cef1f1669d474e7b3b45346ed87a455a168c1d199d9c6492 [email protected] is a typosquat/lookalike of the zod ecosystem that acts as an import-time dropper. index.js unconditionally...

Malicious code in docflow-cryptopro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b838ab488feb43fe2b50d6cd00579d3c1528877ea84d935ca89d8d863528bd25 On require of the package's main, platform.js downloads an opaque platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames...

Malicious code in dolyame-boxy-atom-bnpl-dangerously-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48ce2aa10d245536ed6cfd1903fe1b553eef84d8e949b0bd1b970817b7f13e98 On require of the package, index.js loads loader.js which reconstructs attacker-controlled hostnames via string-split.join'' to evade scanners mirror...

Malicious code in dlp-dlp-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a7f83a18ee0f4d41331997bd85740febbb8d8e581fa9026b83112e55d2b8320 On require'dlp-dlp-core', index.js loads setup.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac,...

Malicious code in dolyame-boxy-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c249dddf9e2ab4659fe99f1945e7b6dd832178da7b207fa86923d8c23ae60143 On require, adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors...

Malicious code in dolyame-boxy-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7992916c62a9926f06f313367b6b684674413ecac4fe8cf1e0130165ae651fc7 On require of the package, index.js loads adapter.js, which downloads a platform-specific native binary from hardcoded destinations assembled via...

Malicious code in dolyame-boxy-atom-bnpl-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f The package's main entry loads setup.js, which on require fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are...

Malicious code in dolyame-boxy-atom-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26bfa012ebc79b0bf89d9eff7b1b0279bba4df11c76f80f6e81171f67d0dd7e5 On require, compat.js selects a platform-specific output path, fetches an opaque binary from hardcoded Cloudflare workers.dev subdomains assembled at...

Malicious code in dolyame-boxy-atom-bnpl-store-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdce627f475557b2376352c5dbc9cc8970949fdccef36073a4665c01fe4af92f On require, index.js loads platform.js which reconstructs download hostnames from split-and-joined array literals e.g. oob-worker.cf99-9b3.workers.de...

Malicious code in dolyame-boxy-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfa5d8518650ddd83b31e9587264a2ed049a47db5c8452af6d62eb50e9fa336 On load, index.js requires./loader.js which reconstructs anonymous host names via array-join obfuscation...

Malicious code in dolyame-boxy-atom-bnpl-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdafe79f11030f0367fb997cf61cabd383309aca2ba694459be72a97d8023bb7 On require of the package, index.js loads helpers.js which immediately runs an init routine that fetches a platform-specific binary over HTTPS from a...

Malicious code in dolyame-boxy-atom-desktop-bnpl-dangerously-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2f3a20016e1936bdca56ddd0208270b791b048a3d4c7cca682ff83462724bb2 On require of the package, index.js unconditionally loads polyfill.js, which downloads a platform-specific binary from Cloudflare Workers subdomains...

Malicious code in dolyame-boxy-atom-desktop-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd On require, index.js loads bootstrap.js, which reconstructs remote hosts by array.join string concatenation oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-atom-desktop-bnpl-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b63e38f9a4be0ffccf426124ce23e7d5c0ddfde68cc81ad44cbfe75ef22c31c The package's index.js silently loads loader.js via a swallowed try/catch try require'./loader'; catch . loader.js assembles one of three Cloudflare...

Malicious code in dolyame-boxy-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 919c54c4e8e0b08b62f76b85369a9033929f8ea19dfc777b8ece48697229a5ce [email protected] ships a runtime.js module that is unconditionally required from index.js at load time. On import, runtime.js reconstructs...

Malicious code in dolyame-boxy-atom-desktop-bnpl-highlighted-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 539999c456d5c8a3f5e2028b9bd7a0f8ca3ab41af3c67044ef7735e0c9f76845 On require, polyfill.js selects a platform-specific payload, fetches an executable from one of three Cloudflare Workers hosts whose names are assembl...

Malicious code in dolyame-boxy-atom-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fb29bd9c1d233b882994262382b5f0b5b21cb2b868c139720d5ec9533ce9301 On require of the package, index.js loads helpers.js which invokes setup at module load. setup selects a platform-specific payload path...

Malicious code in dolyame-boxy-desktop-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e20a9180ff2928b0498496b59c96983db044063b8db7c5e258b6518d5daf00a On require of this package, index.js loads bridge.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in dolyame-boxy-component-story-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c0c190f59af98fd97bf6638398afd2a774dc07593d1d954b85fd150d7ce0c32 On require of this package, support.js reconstructs Cloudflare Workers hostnames from split string fragments e.g...

Malicious code in dolyame-boxy-desktop-bnpl-hero-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 036c11daa7712014748d57bc2bca8a37672acffa8f3eaca83161b726ba473fdb On require of the package, helpers.js reassembles hostnames from split string arrays e.g. 'oob-worker.cf102-baf.workers.dev',...

Malicious code in dolyame-boxy-atom-icon-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34c580f021e76e3cff3c4a92cac6c53ef918c49db3c1d0b8eae008dd51dca766 Package advertised as an icon loader but on require the bundled vendor.js downloads a platform-specific executable from obfuscated Cloudflare...

Malicious code in dolyame-boxy-desktop-bnpl-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f786ddb8f05c51044f41661db16ceb96657060ba36d0ead043d430cf4e30a11 Requiring the package loads vendor.js, which reconstructs remote hosts from array-join fragments resolving to Cloudflare Workers hosts such as...

Malicious code in dolyame-boxy-desktop-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ac9b6ff477d28984f8498e58ccc09c6addc4ecce2816fd46f25e5b4cfca49dc On require of this package, index.js loads bridge.js which auto-executes an init routine that fetches a platform-specific binary from runtime-assembl...

Malicious code in dolyame-boxy-desktop-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b6f75040edc2a67f6c4912c7b8ff63ec6bd8dbd35c235bd3787ea24f52d4a2 On require/import, index.js loads./polyfill.js which selects a platform-specific endpoint, fetches bytes over HTTPS from one of several .workers.dev...

Malicious code in dolyame-boxy-desktop-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c756707c26d481934a28ab399aa9cb9db769f3785006b83a97f519ca90f241 On require, index.js loads./platform.js, which assembles OS-specific download URLs from fragmented string pieces pointing at Cloudflare Workers...

Malicious code in dolyame-boxy-desktop-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626b386d1f127bc0ed973dbac051023f0f021b0be476d1cd8678802ef98c5d42 On require of the package, index.js unconditionally loads bootstrap.js, which downloads a platform-specific binary from hostnames assembled via...