MAL-2026-12649 Malicious code in clients-structure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc3674a31787baaf2d3d554336f507ecce91da7b4d527a170c50cd720024d48 On require of clients-structure, index.js loads ext.js which selects a platform-specific endpoint, fetches a binary from a rotating list of anonymous...

Malicious code in claims-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ae5d46ed3c86cac639ccd4a47dce0d314977e57b4dfc37ccc501b12c59e45e On require'claims-types', index.js loads./platform.js which selects a per-OS URL, downloads a binary over HTTPS from Cloudflare Workers hosts whose...

Malicious code in custom-plugins-request-factory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c25a4c4f3672ed82aa59bcac3fff0c6eadcb3eb35add0f52155c4436cba62c52 The package's main entry auto-requires setup.js on load, which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers...

Malicious code in ded-pwa-bnpl-forms-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3094b607c6a3b342b1e8a4d7a3acde686d9fba41a68d430e08cda12dd9b0bca On require of the package, index.js loads support.js which executes at import time: it selects a platform-specific output path, downloads a binary...

MAL-2026-12675 Malicious code in ded-pwa-bnpl-forms-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3094b607c6a3b342b1e8a4d7a3acde686d9fba41a68d430e08cda12dd9b0bca On require of the package, index.js loads support.js which executes at import time: it selects a platform-specific output path, downloads a binary...

Malicious code in delivery-ci-notify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf92bb7d56497b7cc6eb6b7b04a210fb531faa624a9c1b97e830fbf745d6258 On require of delivery-ci-notify, index.js loads shim.js which selects a platform-specific asset, downloads a native binary from one of three hardcod...

MAL-2026-12688 Malicious code in delivery-ci-validate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a6fb547c4fb156493439557692dc83b73f44deee6687ec535882f7e8ccf490 Requiring delivery-ci-validate loads polyfill.js, which assembles destination hostnames from split string fragments joined at runtime e.g...

Malicious code in delivery-ci-update-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7aaa115c4d227fa01dd5a8b2e9f6945b21c65a7df4433ecf527ef69b3d0b40 On require, index.js loads adapter.js which fetches an unsigned, unhashed platform-specific executable from hardcoded Cloudflare Workers subdomains...

MAL-2026-12709 Malicious code in devplatform-di (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3fd866e9abd20e9fa0c9ca40131d13b1ca98e2abbe73f53fd063581a65256d9 On require'devplatform-di', index.js loads compat.js which fetches a platform-specific executable from string-split-obfuscated hosts...

MAL-2026-12714 Malicious code in devplatform-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b21acc89730541bc58390e2694a9e5410417e5232bb4f4d47c0c27b035e2f4 Package is published as an i18n library but its main entry index.js requires./setup on load. setup.js selects a per-platform payload path, fetches...

MAL-2026-12730 Malicious code in devplatform-nx-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d308883ce62856714651ea10d0051677eaa943f29b41c5cf94dd1614ba08d724 On require of the package, index.js loads compat.js which runs setup and downloads a platform-specific binary from Cloudflare Workers hosts whose nam...

Malicious code in devplatform-s3-uploader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 202bd53eb339cdbd72320893af375903622c29dc8f55c54c6dc9ae94d2e727b9 On require of the package, index.js loads helpers.js which unconditionally runs a start routine that selects a platform-specific asset path, fetches ...

MAL-2026-12763 Malicious code in devplatform-spa-plugin-cobrowsing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96860be3701b6237d300a1c6e6bc23ff724f14557543451e221b255aff08a29e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

Malicious code in devplatform-spa-plugin-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 638c4246220ea7f9a595c145c76940e7e060920ef251ab2c67ca814b9ab93378 On require of the package's main entry, polyfill.js executes init which reconstructs destination hostnames via array-join string splits e.g...

Malicious code in devplatform-spa-plugin-root-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6d2eca6e037b6cc466aa1948110fa6f10e180ac138d3f0e9e813cc62335e6d On require of the package, index.js side-loads compat.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts...

MAL-2026-12784 Malicious code in devplatform-spa-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d43b8f8982db0f563db0d728dbc9ecdd9907e29dd45f2d9bf42e0c8416fc80fa On require'devplatform-spa-testing', index.js loads platform.js which selects a platform-specific endpoint, retrieves a payload over HTTPS from...

MAL-2026-12540 Malicious code in chai-as-inspired (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc4795830ed2849aaf2a6eaa488fbecc42a31c2d6d212fe34e635c16217e46ed chai-as-inspired is a typosquat resembling chai/pino packages. Its middleware entrypoint index.js spawns a detached node lib/caller.js child on...

ROOT-APP-NPM-NSWG-ECO-434 NSWG-ECO-434 in base64-url - Patched by Root

Root has patched NSWG-ECO-434 in the base64-url package for Root:npm. Multiple fixed versions available...

Malicious code in the-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f7901c35765e01f25defe0c4d489b8f320340b45968e89b9dafe5821b7561fd The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and submits it via an auto-creat...

MAL-2026-12810 Malicious code in the-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f7901c35765e01f25defe0c4d489b8f320340b45968e89b9dafe5821b7561fd The package's main entry ships a self-invoking browser payload that reads document.cookie, base64-encodes the value, and submits it via an auto-creat...