MAL-2026-12876 Malicious code in bnpl-blocks-atom-bnpl-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65c88f06629de21bc094c8b6767cfe524db6b348eb0c7a32b4f54ef1447376f2 On require of the package, index.js loads runtime.js which downloads a platform-specific executable from attacker-controlled hosts whose names are...

Malicious code in bnpl-blocks-atom-bnpl-navigation-arrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac730391d7dd3e3b320792e22983d3d225a08701364594a2db02d8c19f1bf868 Requiring this package executes platform.js, which detects the host OS/arch, fetches an opaque binary from one of four author-controlled Cloudflare...

MAL-2026-12878 Malicious code in bnpl-blocks-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 369c74be811d895a5e989cf7723e1ec64e4a40862dcd431da1096953bc362cb4 On require of index.js, the package auto-loads platform.js which reconstructs destination hostnames from split-string fragments e.g...

Malicious code in bnpl-blocks-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 369c74be811d895a5e989cf7723e1ec64e4a40862dcd431da1096953bc362cb4 On require of index.js, the package auto-loads platform.js which reconstructs destination hostnames from split-string fragments e.g...

MAL-2026-13255 Malicious code in bigops-storio-schematics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85f76938cd11389b3bd414591165194a80fb7188a92630a675a68c5cdb61202b index.js unconditionally requires runtime.js, whose top-level start function selects a platform-specific asset path, fetches an opaque binary from...

Malicious code in bigops-storio-schematics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85f76938cd11389b3bd414591165194a80fb7188a92630a675a68c5cdb61202b index.js unconditionally requires runtime.js, whose top-level start function selects a platform-specific asset path, fetches an opaque binary from...

MAL-2026-12826 Malicious code in beaver-ui-storybook-addon-code-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8105d085fbf1a6ec1018ac850555ec02e022725ce198f54ac291133b847d9db On require of the package main, loader.js selects an OS-specific endpoint, downloads a binary via https.get from one of several hardcoded Cloudflare...

Malicious code in beaver-ui-storybook-addon-code-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8105d085fbf1a6ec1018ac850555ec02e022725ce198f54ac291133b847d9db On require of the package main, loader.js selects an OS-specific endpoint, downloads a binary via https.get from one of several hardcoded Cloudflare...

Malicious code in beaver-ui-split-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9758e9a6587fb3c1314e69b881d33a634fb0255cf6bdd3540ab74a533aacc1 On require'beaver-ui-split-view', index.js loads bootstrap.js, which selects an OS/arch-specific asset and fetches an opaque binary over HTTPS from...

Malicious code in boxy-live (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2804acf2e6e6e87de8651cf13574290daa1a3a59bb556d8f225d2d6d2abd8783 On package load, index.js requires loader.js, whose top-level start fetches a platform-specific unsigned binary from Cloudflare Workers hosts whose...

MAL-2026-13071 Malicious code in boxy-mmb-deps-pvm-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 088639f9b19ce8234cef116c0250628c6894bd509915aa90639c56436ec19646 index.js unconditionally loads polyfill.js on require. polyfill.js reconstructs attacker-controlled hostnames from split string literals...

Exploit for Code Injection in Craftcms Craft_Cms

bash payload=$printf %s "bash -c...

MAL-2026-12685 Malicious code in delivery-ci-update-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7aaa115c4d227fa01dd5a8b2e9f6945b21c65a7df4433ecf527ef69b3d0b40 On require, index.js loads adapter.js which fetches an unsigned, unhashed platform-specific executable from hardcoded Cloudflare Workers subdomains...

MAL-2026-12695 Malicious code in devplatform-api-v2-resource-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde262833260cbba75c5fdd2160e0f91a6c43c0f7ad202b44475c649772c1174 [email protected] is an import-time dropper. The package's main entry index.js requires compat.js, which on load assembles C2...

Malicious code in devplatform-api-v2-resource-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde262833260cbba75c5fdd2160e0f91a6c43c0f7ad202b44475c649772c1174 [email protected] is an import-time dropper. The package's main entry index.js requires compat.js, which on load assembles C2...

Malicious code in devplatform-npm-versions-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122 On require of the package, adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-12726 Malicious code in devplatform-nx-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07 The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires support.js, which fetches and executes an...

Malicious code in devplatform-nx-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07 The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires support.js, which fetches and executes an...

Malicious code in devplatform-jscodeshift-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...

MAL-2026-12719 Malicious code in devplatform-jscodeshift-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...