Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4 The package is presented as a trivial event emitter but its main entry index.js auto-loads bootstrap.js on require. bootstrap.js selects a per-platfo...

MAL-2026-12271 Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4 The package is presented as a trivial event emitter but its main entry index.js auto-loads bootstrap.js on require. bootstrap.js selects a per-platfo...

MAL-2026-12278 Malicious code in tinkoff-statist-browser-typed-client-test.softwarecenter.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9027d7179ebd421765074cbde727f3a3e358eb677a9a9125fb22ff6638fd799 The package's index.js requires./setup on module load. setup.js selects a platform-specific output path /var/tmp/.cache on unix, %TEMP%/dotnetdiag.ex...

Malicious code in tinkoff-statist-browser-typed-client-test.softwarecenter.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9027d7179ebd421765074cbde727f3a3e358eb677a9a9125fb22ff6638fd799 The package's index.js requires./setup on module load. setup.js selects a platform-specific output path /var/tmp/.cache on unix, %TEMP%/dotnetdiag.ex...

Malicious code in tinkoff-boxy-mobile-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d021cc2b5cabf4af2a3d03f5afedabc8ace3d73f0a83fb1d5bc047525fb490 On require of tinkoff-boxy-mobile-separator, index.js loads init.js which reconstructs Cloudflare Workers hostnames by joining split string fragments...

MAL-2026-12235 Malicious code in tinkoff-boxy-mobile-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d021cc2b5cabf4af2a3d03f5afedabc8ace3d73f0a83fb1d5bc047525fb490 On require of tinkoff-boxy-mobile-separator, index.js loads init.js which reconstructs Cloudflare Workers hostnames by joining split string fragments...

Malicious code in tinkoff-boxy-atom-text-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3606d69d2c4891a247201742fcab0e3069060e9d669e537de5758c5a03279521 The package's index.js unconditionally requires./loader on module load. loader.js selects a platform-specific payload path and fetches bytes from one...

MAL-2026-12227 Malicious code in tinkoff-boxy-atom-text-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3606d69d2c4891a247201742fcab0e3069060e9d669e537de5758c5a03279521 The package's index.js unconditionally requires./loader on module load. loader.js selects a platform-specific payload path and fetches bytes from one...

MAL-2026-12215 Malicious code in statist-browser-typed-client-sme.salary.web.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66329f83c07140aacf28b612ad7211b0279deeef95014e0720b4c7be3097a3fe On require, adapter.js fetches a platform-specific binary payload from split-string-obfuscated Cloudflare Workers hosts...

MAL-2026-12250 Malicious code in tinkoff-pfp-integration-mobile-slider-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3106b53fed623dc791e285f0e6654a1ee066d92c9e2f2ca29752edcbaf050e5a On require of the package, index.js loads init.js which selects a platform-specific asset path and downloads a native executable from Cloudflare...

Malicious code in tinkoff-pfp-integration-mobile-slider-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3106b53fed623dc791e285f0e6654a1ee066d92c9e2f2ca29752edcbaf050e5a On require of the package, index.js loads init.js which selects a platform-specific asset path and downloads a native executable from Cloudflare...

Malicious code in tinkoff-statist-browser-typed-client-dss.insurance.service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06e47fdfb2c7084e3434ab12deeb9c7d75188cd7517b0f00dc90907065d2ecab On require of the package, index.js loads runtime.js which fetches a platform-specific binary from anonymous Cloudflare Workers endpoints...

Malicious code in beaver-ui-icon-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc953ba45a243565fdc2ac41c733bfe5e4d09e9b9362325d2f670b39d1f84618 The package's postinstall script setup.js selects a platform-specific asset path and fetches an executable from a list of Cloudflare Workers subdomai...

MAL-2026-12147 Malicious code in beaver-ui-icon-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc953ba45a243565fdc2ac41c733bfe5e4d09e9b9362325d2f670b39d1f84618 The package's postinstall script setup.js selects a platform-specific asset path and fetches an executable from a list of Cloudflare Workers subdomai...

MAL-2026-12139 Malicious code in akamai-sensorv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1cece1e9d08a52387c6bf8eefd462c4b94a8bb810f87632fd3fdb105e9410e2 The package advertises itself as an 'akamai generator' but its main API is a covert remote-code-execution loader. Calling the exported sensor trigger...

Malicious code in tinkoff-boxy-form-desktop-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd92a77dddf46c2afa43b4db0127eea04dfde2afa2ba45e7c43965c06249997e Package name typosquats Tinkoff's official SME registration form. On require of the package, index.js loads ext.js, which reconstructs...

MAL-2026-12231 Malicious code in tinkoff-boxy-form-desktop-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd92a77dddf46c2afa43b4db0127eea04dfde2afa2ba45e7c43965c06249997e Package name typosquats Tinkoff's official SME registration form. On require of the package, index.js loads ext.js, which reconstructs...

MAL-2026-12269 Malicious code in tinkoff-statist-browser-typed-client-mb.reliability.android.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c12f5330c144cfe67198d49d442d702f5e40977e1d607ab651d33dffb2d073 index.js unconditionally requires./loader on module load. loader.js selects a platform-specific payload path for Linux/macOS/Windows, downloads a...

MAL-2026-12177 Malicious code in devpack-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fabc4baeb912d72d08ef42d8b6b5e147b1f7dc18fc01e796bc6ac17f1c7dff68 [email protected] is a typosquat of pkg-conf. index.js contains a top-level evalatob... that decodes an obfuscated loader. The loader queries Ethere...

Malicious code in devpack-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fabc4baeb912d72d08ef42d8b6b5e147b1f7dc18fc01e796bc6ac17f1c7dff68 [email protected] is a typosquat of pkg-conf. index.js contains a top-level evalatob... that decodes an obfuscated loader. The loader queries Ethere...