Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from...

MAL-2026-13317 Malicious code in dolyame-boxy-independent-bnpl-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f65bcb53883eb5b3dcd6fe4d8b8ee61e24dad3323aa4ee4431a62b770e17f7a On require, bridge.js downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-ui-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cecad37efa23b83ead95d73e1b0ef07dbb8473dfd76645f4ceed5cf7939653f4 The package is published as a React UI component library but on require'dolyame-ui-menu', index.js loads polyfill.js which fetches a platform-specifi...

MAL-2026-13176 Malicious code in dolyame-ui-portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cf459576a54fb40358c8e22e4283559ce302a6d6e2c6cd545b48ae9be4d8ccf index.js unconditionally requires./bridge on load. bridge.js assembles Cloudflare Workers hostnames oob-worker.cf100-3-.workers.dev and a DNS-TXT...

Malicious code in bigops-timeline-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a6a5b474ef344ddb8aa478f73099e3644817aa8a87199eaa3c46f03d27baa13 On require of bigops-timeline-ui, index.js loads./adapter.js which fetches a platform-specific binary from Cloudflare Workers hosts whose names are...

Malicious code in bigops-watchdog-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65df39f269239434211427140c77c096d41d8de8800667ef39a27bf89572c67 On require of bigops-watchdog-worker, index.js loads runtime.js which reconstructs remote hostnames from split-string fragments e.g. joining...

MAL-2026-12856 Malicious code in bigops-watchdog-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65df39f269239434211427140c77c096d41d8de8800667ef39a27bf89572c67 On require of bigops-watchdog-worker, index.js loads runtime.js which reconstructs remote hostnames from split-string fragments e.g. joining...

MAL-2026-12872 Malicious code in bnpl-blocks-atom-bnpl-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe2cdda88c39101955d7333e81f68b9cefe2dbfab23862351194168e2c61e5e9 index.js unconditionally requires./support at package load. support.js reconstructs a list of Cloudflare Workers hostnames...

Malicious code in bnpl-blocks-atom-bnpl-radio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73e47adf2b698665ad917ed4a512279a35c56dc9683950843d18f207d91767e2 Requiring this package loads polyfill.js, whose top-level initialization downloads a platform-specific binary from runtime-reassembled hosts...

MAL-2026-12980 Malicious code in bnpl-blocks-mobile-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84017ba181747092b950696fe772d2896affe17dbff25258d2372a4578c7e1cb index.js requires./loader on load. loader.js assembles network destinations at runtime by concatenating split string fragments e.g...

MAL-2026-12994 Malicious code in bnpl-blocks-mobile-bnpl-image-with-caption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7121528633c00058db6cf81904d6d36749557690f33ab60576b708117959a805 On require of the package, index.js loads polyfill.js which selects a platform-specific endpoint and downloads a binary over HTTPS from one of three...

Malicious code in bnpl-blocks-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b85856c1395372c88e148fdabb77be27f0556ad68ba3eb7f5c62d063a9154607 On require'bnpl-blocks-playwright', index.js loads bridge.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains...

Malicious code in boxy-mops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d377c600e4c23a91ca7b5c4465804849e0427d7f14392877ad961244142fe477 On require, boxy-mops loads compat.js, which assembles attacker-controlled hostnames from split string fragments resolving to...

MAL-2026-12592 Malicious code in checkout-storage-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1 On require of checkout-storage-service, helpers.js selects a platform-specific endpoint and downloads bytes over HTTPS from a rotating list of...

MAL-2026-12673 Malicious code in ded-ps-ded-ps-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfe3941502d9792a1ad46ba7ed447227ef74d1c45cce8e9996005218d47f0f51 On require, index.js loads init.js, which selects a platform-specific endpoint and fetches an opaque native binary from Cloudflare Workers hosts whos...

SkillSpector v2.5.3

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. Research shows that 26.1% of...

Malicious code in devplatform-nx-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8fa5cc0213b5b28609ba1035cb25dd701d3e8690f25b5a3b4dc37f5139fa740 On require of the package, index.js loads support.js, whose top-level init selects a platform-specific asset, downloads a native binary from one of...

Malicious code in @wololasod/tiny-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b3ca8617b237bb3d8fd7d14aa18554118397e7b7faaea2e87cdd8433fef7a8f The package advertises itself as a tiny ID generator but its main entry dist/index.cjs contains an obfuscator.io + RC4 string-array VM that, on...

MAL-2026-12373 Malicious code in eventea-diag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9941ff32c3b2d52ea7b7cccd4af391bfe359cf3766c4f22c484d1a51e178ab6c On require of the package, index.js loads shim.js which downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains...

MAL-2026-12354 Malicious code in code-analyzer-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41c70b60414be4e045ae4c1eff1ab33b674c78cc9e2eadadfbdca6317de3a251 index.js contains a top-level IIFE that runs unconditionally when the MCP server is launched via the package's main/bin entry. The IIFE spawns calc.e...