Malicious code in bnpl-blocks-independent-bnpl-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56d26dece8e18d84828b36740c2f6b04f29f695b2a0df9c6699b58cc1f83e11a On require of this package, index.js loads adapter.js which selects a platform-specific asset path, reassembles destination hostnames from split...

Malicious code in bnpl-blocks-mobile-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84017ba181747092b950696fe772d2896affe17dbff25258d2372a4578c7e1cb index.js requires./loader on load. loader.js assembles network destinations at runtime by concatenating split string fragments e.g...

MAL-2026-12980 Malicious code in bnpl-blocks-mobile-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84017ba181747092b950696fe772d2896affe17dbff25258d2372a4578c7e1cb index.js requires./loader on load. loader.js assembles network destinations at runtime by concatenating split string fragments e.g...

MAL-2026-12969 Malicious code in bnpl-blocks-independent-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8e34f125883bf487e46fede3b2094978e853711c0688c8712cc5628e929f0ad Requiring this package triggers init.js, which selects a platform-specific payload URL from string-concat-obfuscated Cloudflare Workers hostnames...

Malicious code in bnpl-blocks-independent-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8e34f125883bf487e46fede3b2094978e853711c0688c8712cc5628e929f0ad Requiring this package triggers init.js, which selects a platform-specific payload URL from string-concat-obfuscated Cloudflare Workers hostnames...

Malicious code in bnpl-blocks-mobile-bnpl-category-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3b498a386a4aeab43aedc022880d8bf90e2d8feb2cc94bafe313fa73c09b4b1 On any require of this package, index.js loads loader.js, which reconstructs destination hostnames at runtime from array-join fragments...

MAL-2026-12984 Malicious code in bnpl-blocks-mobile-bnpl-category-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3b498a386a4aeab43aedc022880d8bf90e2d8feb2cc94bafe313fa73c09b4b1 On any require of this package, index.js loads loader.js, which reconstructs destination hostnames at runtime from array-join fragments...

Malicious code in bnpl-blocks-mobile-bnpl-feedback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28f1214c6f46b90fa1bf81bde9a79c81a5193e84969ef756f50cbf895c49515b On require of the package, index.js loads shim.js which selects a platform-specific binary from a list of string-split-obfuscated Cloudflare Workers...

MAL-2026-12988 Malicious code in bnpl-blocks-mobile-bnpl-feedback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28f1214c6f46b90fa1bf81bde9a79c81a5193e84969ef756f50cbf895c49515b On require of the package, index.js loads shim.js which selects a platform-specific binary from a list of string-split-obfuscated Cloudflare Workers...

Malicious code in bnpl-blocks-mobile-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a2921266e52f201547a9cd08fabd37f291c1db3c02e22c6b546206dfb9c20d On require of this package, index.js loads adapter.js which invokes bootstrap at module load. The code selects a platform-specific endpoint, assemble...

MAL-2026-12987 Malicious code in bnpl-blocks-mobile-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a2921266e52f201547a9cd08fabd37f291c1db3c02e22c6b546206dfb9c20d On require of this package, index.js loads adapter.js which invokes bootstrap at module load. The code selects a platform-specific endpoint, assemble...

Malicious code in bnpl-blocks-mobile-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d34cee08f3d1aef3c44a67fde619cdd51f0653434204b2390064eb0baad9f2c2 The package's main entry requires./compat on load, which selects a platform-specific payload Windows.exe, Linux ELF, macOS Mach-O, downloads it over...

Malicious code in bnpl-blocks-mobile-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 771f50f1caeef482c61cb9cac57b07ec92059e3e9cb7cf9ee2ef1d9f87a4b59c On require of this package, index.js loads loader.js, which selects a platform-specific payload path and fetches an opaque binary over HTTPS from a...

MAL-2026-12983 Malicious code in bnpl-blocks-mobile-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 771f50f1caeef482c61cb9cac57b07ec92059e3e9cb7cf9ee2ef1d9f87a4b59c On require of this package, index.js loads loader.js, which selects a platform-specific payload path and fetches an opaque binary over HTTPS from a...

MAL-2026-12998 Malicious code in bnpl-blocks-mobile-bnpl-news-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad0b3eb1ec7b37f8483e53212833b81d542aabb784a525e56ce3b2b6e1e48217 The package's index.js loads runtime.js on require, which selects a platform-specific asset, fetches an opaque binary over HTTPS from author-controll...

Malicious code in bnpl-blocks-mobile-bnpl-news-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad0b3eb1ec7b37f8483e53212833b81d542aabb784a525e56ce3b2b6e1e48217 The package's index.js loads runtime.js on require, which selects a platform-specific asset, fetches an opaque binary over HTTPS from author-controll...

MAL-2026-13004 Malicious code in bnpl-blocks-mobile-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a76b1d07f3d0357fa471ba2b1e5a0052b1b789f96763446a20e19cf7ac7ab11 On require of the package, index.js loads bootstrap.js which fetches a platform-specific binary payload over HTTPS from author-controlled hosts whose...

MAL-2026-12990 Malicious code in bnpl-blocks-mobile-bnpl-grid-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 792cb2358938b5e58ee7cd132526e95184827417dd7d66c21d6e9ae281145a70 On require of the package, index.js loads runtime.js, which assembles a rotating list of C2 hostnames from array-joined string fragments resolving to...

Malicious code in bnpl-blocks-mobile-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 295c0eb6e0491ca81198ae9cbeb921b3658d573f98bd43e82e6bbc0fe953683b On require of the package's main, index.js unconditionally loads bootstrap.js, which fetches a platform-specific binary from Cloudflare Workers...

Malicious code in bnpl-blocks-mobile-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36d339646cbe6f6c012c79bcb2c040941c777f5b76d67677bab4e11a3c46785d index.js unconditionally requires./setup.js when the module is loaded. setup.js selects a platform-specific payload for linuxx64, linuxarm64, darwin,...