MAL-2026-12161 Malicious code in bigops-communication-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81c94eee2da1d74fc50236452fc79165eb1183ce0bb874a62a9a7985b6e77206 On require of the package, index.js loads platform.js which invokes init at module top level. init downloads an opaque binary from Cloudflare Workers...

Malicious code in bigops-auth-interceptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 018aa5e99b7e6aa9f438b51ee00164801a2eb1c52e78ad123d0c490dced4b67c On require of [email protected], index.js loads vendor.js which selects a platform-specific binary URL, downloads bytes over HTTPS from...

MAL-2026-12079 Malicious code in volna-boxy-di-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caad3654d755de84a91ca9afc1d7d393a1e2868b54b0b03020780b7878df28f8 On require, index.js loads compat.js which selects a platform-specific payload path, reconstructs C2 hostnames at runtime from split string fragments...

Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

MAL-2026-12073 Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

MAL-2026-12063 Malicious code in checkout-create-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fad899db7785852e2d868bd8e1fef0f8e145426eba747ad1150900dd548b38 On require of the package's main entry, support.js selects a platform-specific asset linuxx64, linuxarm64, darwin, win32, downloads a native binary...

Malicious code in hubert-appointment-v2-task-create-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8f56f6191b24e3c2163a226ca0bb2b76f309fb9a7aabb77f8ebc5ddf63bd109 On require, platform.js reconstructs destination hostnames from split-string arrays e.g. 'oob-worker.cf103-070.workers.dev' assembled from...

MAL-2026-12066 Malicious code in hubert-appointment-v2-task-create-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8f56f6191b24e3c2163a226ca0bb2b76f309fb9a7aabb77f8ebc5ddf63bd109 On require, platform.js reconstructs destination hostnames from split-string arrays e.g. 'oob-worker.cf103-070.workers.dev' assembled from...

MAL-2026-12077 Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...

Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...

Malicious code in sotqa-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6980ae2860be6b9f343e9705a5415dc9ea13a81d285c1dce1f2f56b3dc989fbd On require, sotqa-test loads bootstrap.js which reconstructs C2 hostnames from split-string arrays joined at runtime oob-worker.cf102-baf.workers.dev...

MAL-2026-12071 Malicious code in sotqa-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6980ae2860be6b9f343e9705a5415dc9ea13a81d285c1dce1f2f56b3dc989fbd On require, sotqa-test loads bootstrap.js which reconstructs C2 hostnames from split-string arrays joined at runtime oob-worker.cf102-baf.workers.dev...

Malicious code in shopping-shared-atom-mobile-cart-counter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e70575aedbdc1f873900c0d6f187183ba2cc4088a93caea3d71ab78dc1260 [email protected] loads loader.js from index.js at require time. loader.js assembles C2 hostnames at runtime via...

MAL-2026-12070 Malicious code in shopping-shared-atom-mobile-cart-counter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e70575aedbdc1f873900c0d6f187183ba2cc4088a93caea3d71ab78dc1260 [email protected] loads loader.js from index.js at require time. loader.js assembles C2 hostnames at runtime via...

Malicious code in tinkoff-boxy-mobile-vivid-heading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 979353bc7d77343797621496972688b79dddd8688f1e1021b04a04c4d0572b31 On require of the package, runtime.js selects a platform-specific asset path and fetches an opaque binary over HTTPS from Cloudflare Workers hosts...

MAL-2026-12075 Malicious code in tinkoff-boxy-mobile-vivid-heading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 979353bc7d77343797621496972688b79dddd8688f1e1021b04a04c4d0572b31 On require of the package, runtime.js selects a platform-specific asset path and fetches an opaque binary over HTTPS from Cloudflare Workers hosts...

Malicious code in statist-browser-typed-client-hra.workplacer.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4cbfd025a99e15c1b81ff3a4bab4b52e4575f00b5328fe210fd8fb3fe9df9f8 On require of the package's main entry index.js, polyfill.js downloads a platform-specific binary from one of several hosts whose names are...

MAL-2026-12046 Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f On require of the package's main entry, compat.js runs as a side effect: it selects a per-platform payload, fetches a native binary over HTTPS from o...

Malicious code in tinkoff-boxy-desktop-features-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9792640803b7c90320c995d134baefcd36a52037d1947a3c0262c9d9e5ada168 The package's main entry index.js requires./setup at load time. setup.js assembles obfuscated Cloudflare Workers hostnames via array-join concatenati...

Malicious code in platform-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...