MAL-2026-13528 Malicious code in bnpl-blocks-atom-bnpl-faq-item (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd2fbb910548df40180cd1e71ae6234dddbd8c60b871933d9012bab9f0742bb The package's main entry index.js requires./ext at module load. ext.js downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in dolyame-ui-inputfio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ac05c63a867647d4ec2bf3288918537aeadac4707342a70bfffd42cda60e9c On require of the package, adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments...

MAL-2026-13534 Malicious code in ded-pwa-c-boxy-di (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaf51af402fad446e71b05e085b200e7892ee97e53f8f4593990d7f2b4979037 On require'ded-pwa-c-boxy-di', index.js loads loader.js, which selects a platform-specific remote endpoint hostnames assembled at runtime by joining...

Malicious code in dolyame-ui-inputphone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b85087183768e1521c6facb6dc1f2fe1c838d7f57b8a6a8382bbcee4ac70d165 On require of the package, index.js loads runtime.js which downloads a platform-specific binary from a set of Cloudflare Workers endpoints...

Malicious code in beaver-ui-popover-marker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44380c53af51645632593b0a86d93258bb71aecddc88d9ff3487a7906486e559 On require of the package, index.js loads vendor.js which runs a bootstrap routine that rotates through obfuscated Cloudflare Workers hosts...

MAL-2026-13555 Malicious code in dolyame-ui-cardlogo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24f8a4fc7c7641f4b66eb6a3c8dc9535bd66e2632183c5090e0b7ec909f6c2d On load, index.js requires polyfill.js which unconditionally downloads a platform-specific binary from hostnames reconstructed at runtime via...

Malicious code in dolyame-ui-focusstatehoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b117a5b8b618c0597bcc422e68216cd3626389417aec2940febf447c033a88 On require of the package's main entry index.js, compat.js and lib/telemetry.js run a bootstrap routine that downloads a platform-specific binary...

Malicious code in ded-pwa-c-boxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2293ad47611dcfbb22a3ef81df5e4f27dc942bd2bd2fc5865b60948dc6fc671 On require of the package, index.js loads vendor.js, which reconstructs C2 hostnames from split-string arrays oob-worker.cf102-baf.workers.dev and...

Malicious code in dolyame-ui-iconspack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd91e61b19f55a1d5e8f5d08b9b2b8a7203c8a600289214ff8eb8f26dc913534 The package is published as an icon pack / data-transformation utility, but index.js unconditionally loads shim.js on require, which assembles...

Malicious code in dolyame-ui-flatcorners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ae65f4eadd80905a644647c6f15aee082d428bf5812632a29015eccc924bf1b On require/import of the package, both adapter.js and the advertised main module lib/telemetry.js download an OS-specific binary from obfuscated...

MAL-2026-13588 Malicious code in dolyame-ui-mediainfohoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5c5b48487d5c9507487229c44557753bf7a95300242096be119eba5df451adf On require of the package, platform.js selects a platform-specific asset, downloads an opaque binary from one of three hardcoded Cloudflare Workers...

MAL-2026-13581 Malicious code in dolyame-ui-inputrange (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aae096235cf72db7f2e9908e53fa5a6e7c87718539a9e3452e0e34f7345ca80f On require of dolyame-ui-inputrange, init.js reconstructs a rotating list of Cloudflare Workers hostnames via split-string joins e.g...

Malicious code in dolyame-ui-inputrange (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aae096235cf72db7f2e9908e53fa5a6e7c87718539a9e3452e0e34f7345ca80f On require of dolyame-ui-inputrange, init.js reconstructs a rotating list of Cloudflare Workers hostnames via split-string joins e.g...

MAL-2026-13564 Malicious code in dolyame-ui-dataqa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c924fc6297738267a66dffbb2d06dcca26e888b5c3abd1f10b20c22faa3e3b7 On require of index.js, the package loads polyfill.js and lib/telemetry.js which download a platform-specific native binary from Cloudflare Workers...

Malicious code in devplatform-spa-plugin-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d61b9d430e59b37ce3c13873e37c1dd146d468b6a06f462761e2214acd1d0fa [email protected] executes attacker-controlled code on the installer's host at module import. The package's main entry loa...

MAL-2026-13568 Malicious code in dolyame-ui-eventoutside (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d57db31d52ade4e7de9ebb32a078ab75bf12fb7d40cdfb0caf987e5ef62229a On require of dolyame-ui-eventoutside, bootstrap.js selects a platform-specific URL, downloads a binary from string-split-obfuscated Cloudflare Worke...

Malicious code in dolyame-ui-eventoutside (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d57db31d52ade4e7de9ebb32a078ab75bf12fb7d40cdfb0caf987e5ef62229a On require of dolyame-ui-eventoutside, bootstrap.js selects a platform-specific URL, downloads a binary from string-split-obfuscated Cloudflare Worke...

MAL-2026-13543 Malicious code in devplatform-api-v1-resources (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58312f0f83e88c3dbd6f62bc334db255d0e3d5c6aed0d8d859dd0b17ce77557c On require of the package's main entry, setup.js fetches a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at...

Malicious code in delivery-ci-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25daa792f30733f69d4530266b44c1b6ba9a5f4d11f47cce95b714792a39ca89 On require of delivery-ci-cli, index.js loads bootstrap.js which downloads a platform-specific native binary from string-split-obfuscated Cloudflare...

MAL-2026-13527 Malicious code in bnpl-blocks-atom-bnpl-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3db8a9fa19a0529093120a57fddb0821928cd0050c4f9062956eb73a80fc17b0 On require of the package main, polyfill.js runs an async bootstrap that reconstructs network destinations from string-split fragments...