MAL-2026-12863 Malicious code in bnpl-blocks-atom-bnpl-anchor-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c841de8c355f3970534d5ec0f0c5eb63ed72a4d70f8d715c2e781c276acdb20 On require of bnpl-blocks-atom-bnpl-anchor-menu, index.js loads loader.js which assembles hostnames from split-string arrays evading static analysis,...

MAL-2026-12866 Malicious code in bnpl-blocks-atom-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35d35af02d640655669a475465b8fc992dc8b79950584824dab0e86c285f8b01 On require of the package, index.js loads polyfill.js, which fetches a platform-specific opaque binary from obfuscated Cloudflare Workers subdomains...

Malicious code in bnpl-blocks-atom-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35d35af02d640655669a475465b8fc992dc8b79950584824dab0e86c285f8b01 On require of the package, index.js loads polyfill.js, which fetches a platform-specific opaque binary from obfuscated Cloudflare Workers subdomains...

MAL-2026-12872 Malicious code in bnpl-blocks-atom-bnpl-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe2cdda88c39101955d7333e81f68b9cefe2dbfab23862351194168e2c61e5e9 index.js unconditionally requires./support at package load. support.js reconstructs a list of Cloudflare Workers hostnames...

Malicious code in bnpl-blocks-atom-bnpl-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe2cdda88c39101955d7333e81f68b9cefe2dbfab23862351194168e2c61e5e9 index.js unconditionally requires./support at package load. support.js reconstructs a list of Cloudflare Workers hostnames...

Malicious code in bnpl-blocks-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953d88d16a72d63369a076b864facc257f63385eb38d220ca649b8712ff50277 On require, index.js loads setup.js which selects a platform-specific binary path for linux/darwin/win32, downloads it over HTTPS from hardcoded...

MAL-2026-12871 Malicious code in bnpl-blocks-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953d88d16a72d63369a076b864facc257f63385eb38d220ca649b8712ff50277 On require, index.js loads setup.js which selects a platform-specific binary path for linux/darwin/win32, downloads it over HTTPS from hardcoded...

Malicious code in bnpl-blocks-atom-bnpl-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e57d88037b98733cb7376fa7fa11e80d1d6eb6f9373a7d6e1b555e96039b3abe On require of the package, index.js unconditionally loads polyfill.js, which downloads a platform-specific binary from one of three obfuscated...

MAL-2026-12864 Malicious code in bnpl-blocks-atom-bnpl-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e57d88037b98733cb7376fa7fa11e80d1d6eb6f9373a7d6e1b555e96039b3abe On require of the package, index.js unconditionally loads polyfill.js, which downloads a platform-specific binary from one of three obfuscated...

Malicious code in bnpl-blocks-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd082c1e27c32145bec8b47cf81fa12cde384fd542629dd340c514d71728f8 On require, index.js loads ext.js which assembles Cloudflare Workers hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

MAL-2026-12868 Malicious code in bnpl-blocks-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd082c1e27c32145bec8b47cf81fa12cde384fd542629dd340c514d71728f8 On require, index.js loads ext.js which assembles Cloudflare Workers hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

Malicious code in bnpl-blocks-atom-bnpl-image-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893348e540e6c6a6cb856324bb2379d838bead9f4d2ceab1ae7c3509094871f6 On require of the package, index.js loads compat.js, which reconstructs C2 hostnames from string-split arrays e.g.,...

MAL-2026-12877 Malicious code in bnpl-blocks-atom-bnpl-image-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893348e540e6c6a6cb856324bb2379d838bead9f4d2ceab1ae7c3509094871f6 On require of the package, index.js loads compat.js, which reconstructs C2 hostnames from string-split arrays e.g.,...

Malicious code in bnpl-blocks-atom-bnpl-base-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7ff15e65896892e348d28080e20d974d32a0f8cd2bb5b523e63b9b3d35395e3 On require of the package, index.js loads polyfill.js, which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev,...

MAL-2026-12865 Malicious code in bnpl-blocks-atom-bnpl-base-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7ff15e65896892e348d28080e20d974d32a0f8cd2bb5b523e63b9b3d35395e3 On require of the package, index.js loads polyfill.js, which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev,...

Malicious code in bnpl-blocks-atom-bnpl-news-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcaf0c737c210018a282e73bbd1570e041a0c70f1043dcdd614e93ac64d8dd68 On require of this package, helpers.js selects a platform-specific URL, fetches an opaque binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12882 Malicious code in bnpl-blocks-atom-bnpl-news-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcaf0c737c210018a282e73bbd1570e041a0c70f1043dcdd614e93ac64d8dd68 On require of this package, helpers.js selects a platform-specific URL, fetches an opaque binary from obfuscated Cloudflare Workers hosts...

Malicious code in bnpl-blocks-atom-bnpl-integrations-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2708bb1921034553386778769eccfeb8858cc65d8890b438cb7dc07bfb1eb60 On require, the package's main entry loads ext.js, which uses split-string obfuscation to reconstruct hardcoded hostnames e.g...

MAL-2026-12879 Malicious code in bnpl-blocks-atom-bnpl-integrations-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2708bb1921034553386778769eccfeb8858cc65d8890b438cb7dc07bfb1eb60 On require, the package's main entry loads ext.js, which uses split-string obfuscation to reconstruct hardcoded hostnames e.g...

MAL-2026-12878 Malicious code in bnpl-blocks-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 369c74be811d895a5e989cf7723e1ec64e4a40862dcd431da1096953bc362cb4 On require of index.js, the package auto-loads platform.js which reconstructs destination hostnames from split-string fragments e.g...