MAL-2026-13311 Malicious code in dolyame-boxy-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3 On require of dolyame-boxy-fonts, index.js unconditionally loads./loader.js, which reconstructs C2 hostnames from split-string arrays Cloudflare...

MAL-2026-13314 Malicious code in dolyame-boxy-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-boxy-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts...

MAL-2026-13317 Malicious code in dolyame-boxy-independent-bnpl-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f65bcb53883eb5b3dcd6fe4d8b8ee61e24dad3323aa4ee4431a62b770e17f7a On require, bridge.js downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints oob-worker.cf100-416.workers.dev,...

MAL-2026-13318 Malicious code in dolyame-boxy-independent-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681 On require of the package, index.js loads vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of...

Malicious code in dolyame-boxy-independent-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c2f5f635baa82fb1cc166956476dc3d7560c0c5d9e49a29aa4123256fdd9310 On require of the package, index.js unconditionally loads bootstrap.js, which selects a platform-specific endpoint and downloads an opaque binary fro...

MAL-2026-13328 Malicious code in dolyame-boxy-independent-bnpl-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f29e1e3b6b3a01a935dbcd19077e516c17d31c3674078ecfe2cd112b0137437 On require, index.js loads init.js which reconstructs hostnames from split-string arrays e.g. 'oob-worker.cf102','-baf.workers.','dev'.join'' and...

Malicious code in dolyame-boxy-independent-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d558b476b362ab912d18912a13c79e326b5fcdcdbe73b0f292d94aa89ac732d On require of the package, index.js loads runtime.js, which assembles Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

MAL-2026-13337 Malicious code in dolyame-boxy-mobile-bnpl-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce4829363e0b5248ca374f2bd545b219d5235bbc96936ba5bd9d06f369878538 On require, index.js loads shim.js which selects a platform-specific endpoint from a set of runtime-assembled Cloudflare Workers hosts...

MAL-2026-13340 Malicious code in dolyame-boxy-mobile-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eebb51211941909f17f499585ebb631497d8d82d142a5610518b55b87b144fb The package's main entry index.js requires./compat, which at import time downloads a platform-specific executable from author-controlled endpoints...

MAL-2026-13130 Malicious code in dolyame-boxy-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32273cf2b594fbdf7b09058c383c7d40319001732490771eda7931aaf01bf451 On require'dolyame-boxy-scroll', index.js loads ext.js which selects a platform-specific path linux/darwin/win32, downloads a binary from one of thre...

MAL-2026-13133 Malicious code in dolyame-ui-accordion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a72f168a8501a4518ddfc5cdda24be49bfa8effefbf72fa490bbaa57daa3637 The package is advertised as a React accordion UI component but on require unconditionally loads vendor.js, which downloads a platform-specific binar...

MAL-2026-13131 Malicious code in dolyame-boxy-stories (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0ef68742c490f223f00748b7f5dc82d614231b0d68e430736bbaac9175035e4 On require, index.js loads bridge.js which selects a platform-specific endpoint and downloads a binary from one of three attacker-controlled hosts...

MAL-2026-13129 Malicious code in dolyame-boxy-mobile-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 180d09900ce4462a9d4c9b47dcc26491bfb50aacd5a226a3571211007edb3ad2 index.js unconditionally requires./setup on module load. setup.js branches on process.platform linux/darwin/win32, fetches an opaque binary from...

MAL-2026-13134 Malicious code in dolyame-ui-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f91017d9e387f2441738f4ffe07ce8807a3af9385f2c506cf165fa851d011f53 On require'dolyame-ui-action', index.js loads support.js which downloads a platform-specific binary over HTTPS from Cloudflare Workers hosts whose...

Malicious code in dolyame-ui-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f91017d9e387f2441738f4ffe07ce8807a3af9385f2c506cf165fa851d011f53 On require'dolyame-ui-action', index.js loads support.js which downloads a platform-specific binary over HTTPS from Cloudflare Workers hosts whose...

MAL-2026-13124 Malicious code in ded-aa-liza-ded-aa-liza-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074f0a8014fabe8bdb281c1c07180290bcff2b10d67d723f1c7917ea198d5c5a On require of ded-aa-liza-ded-aa-liza-core, index.js loads ext.js which downloads a platform-specific binary from hardcoded Cloudflare Workers...

MAL-2026-13123 Malicious code in ded-aa-common-ded-aa-common-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30a80297ae44091b682bf8fa68610f345348813d94b2c84e7f82a3183b938a94 On require of the package, index.js loads ext.js which fetches an opaque platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-13141 Malicious code in dolyame-ui-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a12afad0ec2643334f24431df3b2ba84584a9569bca025b50ef52feb6b9493 On require of the package's main entry, shim.js selects a platform-specific payload path and downloads a native binary from one of three Cloudflare...

MAL-2026-13150 Malicious code in dolyame-ui-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b0f03a063fb3a6b8c7605612b587eddfefa6181b85b14654ee93f267dd790e1 On require of the package, index.js loads compat.js, which at module load time downloads a platform-specific binary from hostnames assembled at runti...