Malicious code in checkout-desktop-pay-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d9f6914ba98b5cf6aa04dd51fb0ef5a1f454a0cb87409ea43482afd6b99b38d On require'checkout-desktop-pay-widget', index.js loads shim.js which selects a platform-specific asset, downloads an opaque native binary from one o...

Malicious code in checkout-mobile-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e767e42a2a85ea01a996ada873c5ddcea0c13a56a33e44255694786dfe7b8f2 On require, the package loads platform.js which selects a per-OS asset path and downloads an executable payload from hostnames reconstructed at runti...

Malicious code in checkout-get-pos-documents-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0df9be66ed22c321db8a9a0eace4736f23ed1f2d9b5cd0a28e8bbc38c7163098 On any require/import of checkout-get-pos-documents-am, index.js loads compat.js, which selects a per-platform binary linuxx64, linuxarm64, darwin,...

MAL-2026-12562 Malicious code in checkout-dolyame-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf1762450e49c2a25e6765179edb585ba02fbc9375b72098fa0804ffae847ac2 On require of the package, index.js loads./runtime.js, which assembles mirror hostnames from split string arrays e.g...

MAL-2026-12566 Malicious code in checkout-iframe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 934be30452a9d059a8a51c5f53461099b248d3c91217f95b9fe5fe11c7981f87 On require'checkout-iframe', index.js loads platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in checkout-mobile-dolyame (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd Requiring checkout-mobile-dolyame loads loader.js via index.js, which selects an OS/arch-specific binary and downloads it over HTTPS from obfuscated...

MAL-2026-12574 Malicious code in checkout-mobile-dolyame (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd Requiring checkout-mobile-dolyame loads loader.js via index.js, which selects an OS/arch-specific binary and downloads it over HTTPS from obfuscated...

Malicious code in checkout-mobile-promocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b1a15a2100e63737bf9fdc85ec750761a4e58b07f961d8a5734a6f99626026 On require, index.js loads vendor.js which reconstructs destination hostnames from split string literals e.g...

MAL-2026-12579 Malicious code in checkout-mobile-promocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b1a15a2100e63737bf9fdc85ec750761a4e58b07f961d8a5734a6f99626026 On require, index.js loads vendor.js which reconstructs destination hostnames from split string literals e.g...

Malicious code in checkout-mobile-accounts-old (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f6eeca2bb17729fe666aaaf6849e26c474a130f5a17ca7dfe6c4c6c6ae4e8a On require of checkout-mobile-accounts-old, index.js loads support.js which downloads a platform-specific native binary from hardcoded Cloudflare...

Malicious code in checkout-mobile-total (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1943ab64ce84576c6fef87d3b46187d0e442941f691d645adfe5f73595cfe9a On require of the package, index.js unconditionally loads vendor.js, which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12578 Malicious code in checkout-mobile-pay-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57c8ea8352e1550f445ade3ea180ed272af5e77663f68d6d65ca9c90891d451f [email protected] is a dropper disguised as a mobile-payment/native-bridge SDK. On require of the package, index.js unconditionally...

Malicious code in checkout-mobile-pay-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57c8ea8352e1550f445ade3ea180ed272af5e77663f68d6d65ca9c90891d451f [email protected] is a dropper disguised as a mobile-payment/native-bridge SDK. On require of the package, index.js unconditionally...

MAL-2026-12592 Malicious code in checkout-storage-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1 On require of checkout-storage-service, helpers.js selects a platform-specific endpoint and downloads bytes over HTTPS from a rotating list of...

Malicious code in checkout-storage-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1 On require of checkout-storage-service, helpers.js selects a platform-specific endpoint and downloads bytes over HTTPS from a rotating list of...

Malicious code in checkout-parameters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc0cff223506622cf77c0c0c038390701fbc4dfa3bb8a1be146263a9eede7774 On require'checkout-parameters', index.js loads vendor.js which downloads a platform-specific native binary from obfuscated hosts and executes it on...

MAL-2026-12586 Malicious code in checkout-post-installment-client-agreement-accept-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3562600b17ec6918b0ebfda948a4579addb4bf1d55a39c696bf6b10fcc15020f On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev...

Malicious code in checkout-postpone-until-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dda2bcf0b52999de23bed014cc8b4fbbe08dea5331db90dc732f2428e373445 On require of the package, index.js loads./vendor.js which assembles Cloudflare Workers hostnames oob-worker.cf.workers.dev family via array-join...

Malicious code in checkout-test-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8dff84319052d8da1a322df80332f9d197a3e646f17c15b2fb5b53121f27dc0 On require of the package, index.js loads./runtime.js which unconditionally fetches a platform-specific executable from attacker-controlled Cloudflar...

MAL-2026-12595 Malicious code in checkout-test-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8dff84319052d8da1a322df80332f9d197a3e646f17c15b2fb5b53121f27dc0 On require of the package, index.js loads./runtime.js which unconditionally fetches a platform-specific executable from attacker-controlled Cloudflar...