MAL-2026-12989 Malicious code in bnpl-blocks-mobile-bnpl-floating-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be8101254611004c84932cd102d4fb71dc7e692d67696df081e66bd37ba3088b On require, index.js loads support.js whose top-level main downloads a platform-specific binary from author-controlled hosts assembled via string-arr...

MAL-2026-12981 Malicious code in bnpl-blocks-mobile-bnpl-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d860ca2d011c1e76bfee65b763f4a2d612dfad059ebbde41bb8cb79bc5680808 On require of the package, init.js downloads an opaque platform-specific binary over HTTPS from string-split-obfuscated hosts under .workers.dev...

MAL-2026-12991 Malicious code in bnpl-blocks-mobile-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f511a9eac93e0ef06eeec5ab7ec22330cb092c4fda952ec540f4a9be3fc522f On require of the package, index.js loads bridge.js which fetches an OS-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in bnpl-blocks-mobile-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f511a9eac93e0ef06eeec5ab7ec22330cb092c4fda952ec540f4a9be3fc522f On require of the package, index.js loads bridge.js which fetches an OS-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12996 Malicious code in bnpl-blocks-mobile-bnpl-link-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6203d02c8bfb651950b571dd342ff82e154a3c3867af751a7fb1facdb5bd0f5 On require of the package, support.js selects a platform-specific asset path and fetches a binary over HTTPS from obfuscated .workers.dev hosts...

MAL-2026-12997 Malicious code in bnpl-blocks-mobile-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 295c0eb6e0491ca81198ae9cbeb921b3658d573f98bd43e82e6bbc0fe953683b On require of the package's main, index.js unconditionally loads bootstrap.js, which fetches a platform-specific binary from Cloudflare Workers...

MAL-2026-12999 Malicious code in bnpl-blocks-mobile-bnpl-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d66362455002e754cf596122aa451dcd28d20d3a446b5284d2be76d8db6af4cb index.js requires./setup on module load. setup.js assembles Cloudflare Workers hostnames from split string fragments oob-worker.cf99-9b3.workers.dev,...

Malicious code in bnpl-blocks-mobile-bnpl-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7f199feae1ae38b3dfd2c94cf56ad56ef7ef0fe4e0172a64ef76ddf401bcbcb On require of the package, index.js loads bootstrap.js which selects a platform-specific URL, downloads an executable from obfuscated Cloudflare...

Malicious code in bnpl-blocks-mobile-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e19ad8f13f3c9f4ab6b31c65bad3fb1239ad816c040504428eae8c32740869c index.js unconditionally requires helpers.js, which on module load fetches a platform-specific binary from string-split-obfuscated Cloudflare Workers...

Malicious code in bnpl-blocks-mobile-bnpl-tab-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34cc219a990162733e49aafc255a8abe4c4acd3fc56bce77ae31800fd4791678 On require of the package, index.js side-loads adapter.js which selects a platform-specific asset, downloads bytes over HTTPS from hostnames...

MAL-2026-13010 Malicious code in bnpl-blocks-mobile-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cf4f269562c9f3d9dd234e8c38b6d3408b636a4e743a6106dff730efce473ce On require of the package, index.js loads support.js, which selects a per-platform binary path, downloads bytes from a pool of obfuscated Cloudflare...

MAL-2026-13006 Malicious code in bnpl-blocks-mobile-bnpl-shopping-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc4c244c6348b8ac4006067e983f7a3a58a7d00c5356d10d8d452c02823d1e1 On require of the package, index.js loads init.js which selects a platform-specific endpoint, downloads an opaque binary from rotating Cloudflare...

MAL-2026-13011 Malicious code in bnpl-blocks-mobile-large-bnpl-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4fb3bbd6df612646af310ca9ec9e4d53cdeed9298b7e3e7c0460439b92d2955 On require of this package, loader.js selects a platform-specific asset path /pkg/package, /pkg/package-arm64, /pkg/loadermac, /pkg/package.exe,...

Malicious code in checkout-mobile-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e767e42a2a85ea01a996ada873c5ddcea0c13a56a33e44255694786dfe7b8f2 On require, the package loads platform.js which selects a per-OS asset path and downloads an executable payload from hostnames reconstructed at runti...

Malicious code in checkout-mobile-dolyame (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd Requiring checkout-mobile-dolyame loads loader.js via index.js, which selects an OS/arch-specific binary and downloads it over HTTPS from obfuscated...

Malicious code in checkout-mobile-input-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8121f8e2d367655a7ee2c6b8630e4e6210cee3b5ecded80de7e07f7dc61446e On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames...

Malicious code in checkout-mobile-cashback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82f24faec25bf10df39c7327ce852058d9c23bb9983dae0d4b28c3843f0997f4 [email protected] executes a staged binary dropper on module load. index.js requires./shim, which selects a platform-specific binary UR...

MAL-2026-12573 Malicious code in checkout-mobile-cashback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82f24faec25bf10df39c7327ce852058d9c23bb9983dae0d4b28c3843f0997f4 [email protected] executes a staged binary dropper on module load. index.js requires./shim, which selects a platform-specific binary UR...

MAL-2026-12576 Malicious code in checkout-mobile-input-email (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9c13bf58568e58ecec010552f23cd8eb27cef188f4ed0c905e832fa0f8d0372 On require'checkout-mobile-input-email', index.js loads helpers.js which assembles hostnames via string-array.join"" e.g...

Malicious code in checkout-mobile-bnpl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0734507ccd6f61cb81c277d9e9215c90f0b8cff1bd16f0c3eacd399750d26b4f index.js requires./helpers on load. helpers.js reconstructs three Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...