MAL-2026-12995 Malicious code in bnpl-blocks-mobile-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36d339646cbe6f6c012c79bcb2c040941c777f5b76d67677bab4e11a3c46785d index.js unconditionally requires./setup.js when the module is loaded. setup.js selects a platform-specific payload for linuxx64, linuxarm64, darwin,...

Malicious code in bnpl-blocks-mobile-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fab6b4486cfd526c741063bd79f43ac71b870f9dc859dd2057c35f1121166443 On require, bootstrap.js selects a platform-specific asset path and downloads a binary from one of several Cloudflare Workers hostnames whose names a...

MAL-2026-13000 Malicious code in bnpl-blocks-mobile-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e19ad8f13f3c9f4ab6b31c65bad3fb1239ad816c040504428eae8c32740869c index.js unconditionally requires helpers.js, which on module load fetches a platform-specific binary from string-split-obfuscated Cloudflare Workers...

MAL-2026-13013 Malicious code in bnpl-blocks-post-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd5d8d3c9328912323fee5066e4c32c14904ec3e8b1800f66da0d1749babda0c On require, polyfill.js reconstructs attacker-controlled hostnames from string-split fragments oob-worker.cf103-070.workers.dev, with a DNS-TXT...

MAL-2026-13030 Malicious code in boxy-add-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a91c45a1de3e17ac4c6595c6eac76736684ef353e3040a3e82b42e76911952 On require'boxy-add-script', index.js loads polyfill.js which reconstructs Cloudflare Worker hostnames from string-array fragments...

MAL-2026-13022 Malicious code in bnpl-blocks-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 370e12396e25d7b72ad12f12c31c986e976bd8341f5fa61baa8cd3bb469f968e On require, index.js loads loader.js, which assembles a Cloudflare Workers hostname oob-worker.cf.workers.dev via runtime.join'' string reassembly,...

Malicious code in boxy-bus-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6494a00553cc1e8c7e5ffdd957d31a21a33ab34a252979d7d6d551239fc0f79 On require of the package, index.js loads compat.js which downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts...

Malicious code in boxy-client-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8735372761caed8661ffa03152af889c344333a4bf71f4008e05016343bd7319 On require'boxy-client-loader', index.js loads platform.js which unconditionally invokes start: it fetches a platform-specific executable from...

Malicious code in boxy-add-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8db319ad6492fd57275dc7c83a5a65815e17d2c39fb3daf395bb299742c14701 On require'boxy-add-link', index.js loads compat.js whose top-level bootstrap selects a platform-specific payload URL from string-split-obfuscated...

MAL-2026-13023 Malicious code in bnpl-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b442dc0fb7678cca56e085cb17e0a3e5729eafc9fa34409f704fdcf5822a4efc index.js unconditionally requires./setup on load. setup.js constructs Cloudflare Workers hostnames via string-splitting array joins e.g...

Malicious code in bnpl-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b442dc0fb7678cca56e085cb17e0a3e5729eafc9fa34409f704fdcf5822a4efc index.js unconditionally requires./setup on load. setup.js constructs Cloudflare Workers hostnames via string-splitting array joins e.g...

MAL-2026-13028 Malicious code in boxy-adapter-tramvai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d20d5167abc8703b7b09a0d9698e6d0fd060f4378dfa11ab469af3e6805cfc8e On library load, index.js requires./runtime.js, which selects a platform-specific staging path, fetches an opaque binary from obfuscated Cloudflare...

MAL-2026-13026 Malicious code in bnpl-molecule-mobile-bnpl-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf9828096a3c18e00ad577689ebcf4e4fa304a8702db4a0993063c95182530e On require of the package, index.js loads adapter.js, which runs an asynchronous dropper: it selects a platform-specific asset, downloads an executab...

MAL-2026-13048 Malicious code in boxy-fixture-sb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 569ec5c3f70be02f417bbbe5694a31d6c7d48dadfcacc2500455fffb5ff23d07 On require of boxy-fixture-sb, index.js loads compat.js which reconstructs Cloudflare Workers hostnames from string-split arrays joined at runtime to...

Malicious code in boxy-fixture-sb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 569ec5c3f70be02f417bbbe5694a31d6c7d48dadfcacc2500455fffb5ff23d07 On require of boxy-fixture-sb, index.js loads compat.js which reconstructs Cloudflare Workers hostnames from string-split arrays joined at runtime to...

Malicious code in boxy-debugger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2 boxy-debugger 35.3.4 presents itself as a debugger library, but requiring the package triggers platform.js, which reconstructs attacker-controlled...

Malicious code in boxy-maker-extendable-minihost (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08404cdfbfce9c8e1f4d6b5c4597504b8d1ee580eabfaa960e5d928b4d5505a4 On require, index.js loads bridge.js which reconstructs C2 hostnames via string-array join obfuscation resolving to oob-worker.cf101-3-.workers.dev...

MAL-2026-13054 Malicious code in boxy-live (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2804acf2e6e6e87de8651cf13574290daa1a3a59bb556d8f225d2d6d2abd8783 On package load, index.js requires loader.js, whose top-level start fetches a platform-specific unsigned binary from Cloudflare Workers hosts whose...

Malicious code in boxy-live (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2804acf2e6e6e87de8651cf13574290daa1a3a59bb556d8f225d2d6d2abd8783 On package load, index.js requires loader.js, whose top-level start fetches a platform-specific unsigned binary from Cloudflare Workers hosts whose...

MAL-2026-13057 Malicious code in boxy-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1164ada14e000c3802b5766cdd31ef169e8f15a6d132cbe52d88b0c593b03c2a On require of the package, bridge.js downloads a platform-specific binary from obfuscated Cloudflare workers.dev hosts...