Malicious code in devplatform-confirm-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68424c7a93599d9d6d9391e3236d1ebf1d88fdc590b9c20f1ee615295335e5e8 [email protected] is advertised as a 'confirm input adapter' but on require executes ext.js, which fetches a platform-specific binary...

MAL-2026-12704 Malicious code in devplatform-cli-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bb41284069ba395bf67ceb847dc579c7a79c753ea89107116e91559ebbece2a On require'devplatform-cli-spa', index.js loads support.js which selects a payload by OS and architecture, downloads a native binary over HTTPS from...

Malicious code in devplatform-cli-plugin-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8460a9cc2fce88e69d25156ea88612a5a67ffba26709ce88900d573e2f4b3ea On require of the package, index.js loads bootstrap.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads an...

Malicious code in devplatform-npm-versions-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122 On require of the package, adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-12721 Malicious code in devplatform-npm-versions-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122 On require of the package, adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-12726 Malicious code in devplatform-nx-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07 The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires support.js, which fetches and executes an...

MAL-2026-12722 Malicious code in devplatform-nx-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc4017373371f50665290c944ee840b2ad4a7e745dcb5eb973f977185b150ac7 The package presents as a devkit for the Nx ecosystem but ships a trivial no-op class in index.js alongside a hidden shim.js. On require, index.js...

Malicious code in devplatform-humanize-network-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d18ba9f3689dbc03127a3d82ffe0a6a2a15edf3e7f58b7ca9322499b2b68197 [email protected] advertises itself as a network-error humanizing utility, but on require its index.js unconditionally loads...

MAL-2026-12733 Malicious code in devplatform-po-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 555faac3cf4078b125af0858613813fb3f3bc780a573ddc5713b23d1046c9c71 On require of the package, platform.js detects OS/arch and downloads an opaque binary from Cloudflare Workers hostnames assembled at runtime from...

Malicious code in devplatform-prettier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db5580fbae2ba8f21820a5ba50d8e632cfc12192c3f7cbaeccc8065b4cb5c57d Package presents itself as a prettier configuration/settings manager. index.js requires compat.js at module load, which downloads a platform-specific...

Malicious code in devplatform-select-user (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f7e22a3a99d2447b8bc3e6c0b1f4a92077ce570fdacff421e9fdee6a83e723 On require, the package loads bridge.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers mirrors...

Malicious code in devplatform-select-fields (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25bec256fbaf68018dbca1fad82b3616a04cf8d932b67e30b5164ee74dfc4882 [email protected] executes a binary dropper on any require of the package. index.js loads shim.js, which reconstructs C2 hostnames fro...

MAL-2026-12756 Malicious code in devplatform-spa-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7251ae6bb63fe6eca906250d9300970dddd8d1ebfaad5111bd67dea64e231c01 On require'devplatform-spa-devtools', index.js loads runtime.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hos...

MAL-2026-12768 Malicious code in devplatform-spa-plugin-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88e8b3586c4dee4e4e812d6dc1771ec4bc99bc01058c0ae3d2e8c0cdaa8072c8 index.js unconditionally requires./loader on load. loader.js reassembles Cloudflare workers.dev hostnames oob-worker.cf103-070.workers.dev,...

MAL-2026-12764 Malicious code in devplatform-spa-plugin-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9000b7892808e2b10e702cb2b6f91fc672ad1bc0f58dfdc4c9cf2aa97edff896 On require of the package's main entry, support.js runs an init routine that assembles destination hosts from split string fragments...

MAL-2026-12776 Malicious code in devplatform-spa-plugin-root-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5ac277cf4ba72cf1040b5e06d6875a7228d7ec491d93423198e2b2f92ecb6a Package presents as a Sentry-related SPA plugin but the exported class is an empty stub; index.js requires bootstrap.js, which on load selects a...

Malicious code in devplatform-spa-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6127d0c2ccf2b21fdd6f22244b040c905b2296c86c47cc3c4eb012b61a4c455a On require, index.js loads support.js, which assembles Cloudflare Workers hostnames oob-worker.cf.workers.dev and fallback domain sdk.dl.wel1.ru at...

Malicious code in devplatform-spa-route-tree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eabd446648c0aff2fa8f21202eeee1f46366ff6678c7811f951ff7f2413616cd On require of devplatform-spa-route-tree, index.js loads loader.js which downloads a platform-specific binary from hostnames assembled via array-join...

Malicious code in devplatform-spa-plugin-root-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6d2eca6e037b6cc466aa1948110fa6f10e180ac138d3f0e9e813cc62335e6d On require of the package, index.js side-loads compat.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts...

Malicious code in devplatform-spa-plugin-s3-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7574ec8653333519f651022c1d008eca37f884dc753ad8825cda3facdcd9aa61 On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads a binary over HTTPS from obfuscated...