Malicious code in sme-rko-finance-front-operations-notifications-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3461050b5714edca455c0fd78e979cd5efbdfeeb375016aeb4fe4523f47682 On require, index.js loads adapter.js which selects a platform-specific payload linux x64/arm64, darwin, win32 and fetches it from...

Malicious code in sme-rko-finance-front-operations-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e254c7a7e7f82c38dddb46c9c694cef8f91ac1731565c61e7d17b30d291bd7ac On require of the package, index.js loads shim.js which self-executes an async initializer that assembles platform-specific hostnames from split-stri...

Malicious code in sme-rko-finance-front-operations-widget-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13823f2899a1bfed6b46575763e7ee2629fa4d9388130713a88125b1f38d6dae On require of this package, index.js loads compat.js, which downloads a platform-specific native binary from Cloudflare Workers subdomains under...

MAL-2026-13638 Malicious code in sme-rko-finance-front-operations-holding-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6838cce82eaa89f91af46e82f5153f7318dafd0ebccb4bdbb6251114d95ff51 On require of the package, shim.js executes a bootstrap at module top level that fetches a platform-specific native binary from...

MAL-2026-13648 Malicious code in sme-rko-finance-front-operations-special-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a7bfbc55631ce8b054b20444bf1e335244c998fcf00d1709f951b1afa4cb242 On require of the package, index.js loads support.js which downloads a platform-specific binary from string-concatenated cloudflare workers.dev...

Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4554e1a911548ca2145464d06bcd3c66d69c9fb307a1df557924fb89b3e8c7fd On require of the package, index.js loads bootstrap.js which selects a payload path based on process.platform/arch linuxx64, linuxarm64, darwin, win3...

MAL-2026-13526 Malicious code in bigops-shared-product-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8f6d857df9a0aa674b5354167a3eb1c28634b9e61a9436f19a9ffcb8a8b734 [email protected] ships adapter.js, which is unconditionally loaded via index.js on require. On load it fetches a platform-specific...

Malicious code in dolyame-ui-collapseblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-13582 Malicious code in dolyame-ui-inputsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0146bdcb21ca52b35e8a6f3ca19b7203b1fb5a456eb9dff6ace2eb60348333fe [email protected] is a dropper disguised as a UI input search component. On require, index.js loads./vendor.js, which assembles a mirror...

Malicious code in dolyame-ui-focusstatehoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b117a5b8b618c0597bcc422e68216cd3626389417aec2940febf447c033a88 On require of the package's main entry index.js, compat.js and lib/telemetry.js run a bootstrap routine that downloads a platform-specific binary...

Malicious code in dolyame-ui-memoizeweak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89cabf491f2003602b491a95e2f258760c5f92aa681b87c239c755aa875b352b On require of the package, index.js loads./helpers.js which downloads a platform-specific executable from one of several hardcoded Cloudflare Workers...

MAL-2026-13602 Malicious code in dolyame-ui-tabslayout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb9bd9546be2ed0456e30701775450a1ee33b0caf58387ba91db7018f7d70bcd On require of the package, index.js loads lib/telemetry.js and polyfill.js, both of which contain dropper logic that selects an OS-specific path,...

MAL-2026-13573 Malicious code in dolyame-ui-inlineedit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 944e902d908e84b348449868b669df4e39b78079abc91d44aecdba0966ad124f The package presents itself as a data-transformation/UI utility but on require unconditionally loads setup.js and lib/telemetry.js, both of which...

Malicious code in ded-pwa-c-micro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fc56cb77138607f46edacb74d997af7bcf6e16a868eb729e53316fb1085bca5 On require, index.js loads shim.js which selects a platform-specific binary linuxx64, linuxarm64, darwin, win32, downloads it over HTTPS from hardcod...

Malicious code in dolyame-boxy-independent-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf17b5bab6439a518226a8e3caf758974a9dd8846e587347ea33356c5f780a53 On require of the package, index.js loads runtime.js which selects a platform-specific binary path, downloads an opaque payload from...

MAL-2026-13560 Malicious code in dolyame-ui-contenteditable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9eaf7524b69f412cf3ba4a466c4b9ade04fcaafd989fd3ff0d437e0a3ec941d0 On require of the package, index.js unconditionally loads./compat.js, which reassembles three attacker-controlled Cloudflare Workers hostnames...

MAL-2026-13590 Malicious code in dolyame-ui-noindex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1886afe7141f5c9f5ecfc4fd9869c1f47d47e7170e1fd4247a57959dcd880e On require, index.js loads./ext which selects a platform-specific payload linuxx64/arm64, darwin, win32, downloads an unsigned binary over HTTPS from...

MAL-2026-13508 Malicious code in dolyame-ui-inputpassword (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbe3efece732cd0eab0df9c3fa387540804b7a1f7a911a340c3852e7f2c54674 On require of the package, index.js loads lib/telemetry.js which, together with bootstrap.js, fetches a platform-specific binary from a rotating list...

Malicious code in eacq-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af2bcb4382f02a977f8448ea4f0172253035755b2d1dc363cce80f0389a1ee70 [email protected] contains a dropper reachable both from setup.js and from the main-exported lib/telemetry.js loaded on require'eacq-dialog'. The co...

MAL-2026-13494 Malicious code in bigops-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccbd56ae20f9cc922c12df25456654a649c9bbc963aae4fa95e027f97628c45b Requiring the package index.js -./setup triggers setup.js, which reconstructs destination hostnames from split string fragments e.g...