MAL-2026-13182 Malicious code in dolyame-ui-select (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d1d8b1348e86f0f476ab27b5d5cde1c6a4cfd519e74e526a82263c78a0aaf6b On require of the package, index.js loads bridge.js, which reconstructs C2 hostnames from split string fragments resolving to...

MAL-2026-13195 Malicious code in dolyame-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c23ba8923130746ecc1e526c3a0ee8961ea764dd90d0da71236444d978ce27 dolyame-ui-themes ships a loader.js that is required from the package main index.js at module load. The loader reconstructs C2 hostnames from split...

Malicious code in bigops-tcrm-identity-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 183fa24523e19286718ff854ed8d080c8d8635d6d914a3fbb871c388660fc479 [email protected] is a dropper disguised as a session-management utility. Its main entry index.js requires bootstrap.js on load, which...

Malicious code in bigops-timers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3857e871cb391df75568052701aae6a172eedcee963519c5e6ac9feeff9cbb On require of bigops-timers, index.js loads compat.js which downloads a platform-specific binary from Cloudflare Workers hosts...

MAL-2026-12858 Malicious code in bigops-web-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18ba471d08385d30965c87d85316db28f34e4cd5f6f5eb20f5f9cedc33cd12bf On require, index.js loads helpers.js which selects a platform-specific endpoint and fetches an opaque binary payload from string-split-obfuscated...

Malicious code in bigops-web-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18ba471d08385d30965c87d85316db28f34e4cd5f6f5eb20f5f9cedc33cd12bf On require, index.js loads helpers.js which selects a platform-specific endpoint and fetches an opaque binary payload from string-split-obfuscated...

Malicious code in bnpl-blocks-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b74429ec0cf706ca11dded285a5b89933db6cbbf2b38905c0b0549be62a8f1 On require'bnpl-blocks-analytics', index.js loads compat.js whose top-level start function downloads an OS-specific binary from Cloudflare Workers...

MAL-2026-12861 Malicious code in bnpl-blocks-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b74429ec0cf706ca11dded285a5b89933db6cbbf2b38905c0b0549be62a8f1 On require'bnpl-blocks-analytics', index.js loads compat.js whose top-level start function downloads an OS-specific binary from Cloudflare Workers...

MAL-2026-12851 Malicious code in bigops-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f281ddf755708d180e0d2817df0e23c640fb1ab2d17441c7f35309bb37086bc1 index.js unconditionally requires./vendor at module load. vendor.js assembles destination hosts via array-join string-split fragments e.g...

Malicious code in bnpl-blocks-atom-bnpl-carousel-line (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f49d0a2f45c6a825ed105c2859c618bedcc4643650bf6719c35c47e462c553c8 On require of the package's main entry, index.js loads./shim.js, which assembles attacker-controlled hostnames from string-split arrays e.g...

MAL-2026-12869 Malicious code in bnpl-blocks-atom-bnpl-carousel-line (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f49d0a2f45c6a825ed105c2859c618bedcc4643650bf6719c35c47e462c553c8 On require of the package's main entry, index.js loads./shim.js, which assembles attacker-controlled hostnames from string-split arrays e.g...

Malicious code in bnpl-blocks-atom-bnpl-fade-overflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f78c9360e199f852a5b395b6549e12b6334ec3dce096462a4404a3a0e809f545 On require of this package, index.js loads runtime.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

MAL-2026-12885 Malicious code in bnpl-blocks-atom-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d0716eec6e29280316b67f3e9a98954f501dc73a692d36b68d8106b39bd60fb On require of this package, index.js loads shim.js which assembles obfuscated non-publisher URLs by joining split string fragments resolving to a...

MAL-2026-12899 Malicious code in bnpl-blocks-atom-bnpl-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9b4cea9f3ecb85954dffb42aac8b9869e662493ae87815a7feb8c293e398b79 On require of the package, index.js loads./platform.js which fetches an opaque executable payload from obfuscated Cloudflare Workers hosts...

Malicious code in bnpl-blocks-atom-bnpl-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9b4cea9f3ecb85954dffb42aac8b9869e662493ae87815a7feb8c293e398b79 On require of the package, index.js loads./platform.js which fetches an opaque executable payload from obfuscated Cloudflare Workers hosts...

MAL-2026-12915 Malicious code in bnpl-blocks-desktop-bnpl-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7581057c70b3b5e805e0d56c30e74c4fc88c8c23aa0ceb73a46a2b17b937bb0 On require of the package, index.js loads polyfill.js which selects a platform-specific asset, fetches a binary from string-fragmented Cloudflare...

MAL-2026-12920 Malicious code in bnpl-blocks-desktop-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0028d1bea265a3e3fdcbbe1d43188f3aef4b4c332a995352c19ac5a090c42ac On require of the package, index.js loads support.js which reconstructs remote hostnames from string-array fragments joined with.join'' to defeat...

Malicious code in bnpl-blocks-independent-bnpl-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dab4ebaf15b60e320da6dd04630765fd36dc2c3a012360127653174a350e8c88 index.js requires bootstrap.js on module load. bootstrap.js reassembles obfuscated hostnames via array-join e.g. oob-worker.cf102-baf.workers.dev,...

Malicious code in bnpl-blocks-independent-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8e34f125883bf487e46fede3b2094978e853711c0688c8712cc5628e929f0ad Requiring this package triggers init.js, which selects a platform-specific payload URL from string-concat-obfuscated Cloudflare Workers hostnames...

MAL-2026-12969 Malicious code in bnpl-blocks-independent-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8e34f125883bf487e46fede3b2094978e853711c0688c8712cc5628e929f0ad Requiring this package triggers init.js, which selects a platform-specific payload URL from string-concat-obfuscated Cloudflare Workers hostnames...