Malicious code in checkout-input-card-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cc552600295f6b008943a756a1cf29218d2e6d93a40dd72ea4cd06f039f80cb On require of the package, index.js loads vendor.js, which downloads a platform-specific binary from Cloudflare Workers subdomains...

MAL-2026-12574 Malicious code in checkout-mobile-dolyame (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd Requiring checkout-mobile-dolyame loads loader.js via index.js, which selects an OS/arch-specific binary and downloads it over HTTPS from obfuscated...

MAL-2026-12575 Malicious code in checkout-mobile-input-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8121f8e2d367655a7ee2c6b8630e4e6210cee3b5ecded80de7e07f7dc61446e On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames...

Malicious code in checkout-mobile-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c9d5aebe1a3868e44878f382e7dfd21bcbebf8767f3ff0890b2d6330726f945 On any require/import of this package, index.js loads init.js, which selects a platform-specific endpoint and downloads an opaque binary from...

MAL-2026-12581 Malicious code in checkout-molecule-desktop-status-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247 The package's main entry index.js requires./polyfill on load. polyfill.js immediately runs an async routine that reconstructs several hostnames from...

MAL-2026-12584 Malicious code in checkout-pay-button-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d4bf54bc4e3750c7e9bc6ef385108c37ee00b486858c0576585ef2f88780385 On require, index.js invokes helpers.js which selects a per-OS payload path, fetches a native binary over HTTPS from string-split-obfuscated Cloudfla...

MAL-2026-12580 Malicious code in checkout-mobile-total (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1943ab64ce84576c6fef87d3b46187d0e442941f691d645adfe5f73595cfe9a On require of the package, index.js unconditionally loads vendor.js, which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12578 Malicious code in checkout-mobile-pay-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57c8ea8352e1550f445ade3ea180ed272af5e77663f68d6d65ca9c90891d451f [email protected] is a dropper disguised as a mobile-payment/native-bridge SDK. On require of the package, index.js unconditionally...

MAL-2026-12585 Malicious code in checkout-pay-widget-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e25e8d60e2b9eb81d9e5de2e374fbf25b352e666d163d445461be9ac837669f On require'checkout-pay-widget-logic', index.js loads./vendor.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare...

MAL-2026-12589 Malicious code in checkout-public-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1ca81222c080449cad71d071579738ea810e280c6e8ed3b53647efdde902536 On require of checkout-public-tokens, index.js loads platform.js which downloads an opaque binary payload from hardcoded string-split-obfuscated host...

Malicious code in checkout-public-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1ca81222c080449cad71d071579738ea810e280c6e8ed3b53647efdde902536 On require of checkout-public-tokens, index.js loads platform.js which downloads an opaque binary payload from hardcoded string-split-obfuscated host...

Malicious code in checkout-subscription-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7a62aaa04f6806d8ad86f8c9baaaddde733815a4d2f51bc3db803bf30998f4c On require of the package, index.js loads bootstrap.js inside a try/catch. bootstrap.js reconstructs its download hosts via array.join""...

Malicious code in checkout-storage-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1 On require of checkout-storage-service, helpers.js selects a platform-specific endpoint and downloads bytes over HTTPS from a rotating list of...

Malicious code in checkout-resend-pos-order-sms-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d2c64d2c4df678c1c10b1ca9d9f386e8fd6dd9afe0cb804b11b9dff736ab11 On require of this package, index.js loads polyfill.js which reconstructs attacker-controlled hostnames via array-join concatenation e.g...

MAL-2026-12590 Malicious code in checkout-resend-pos-order-sms-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d2c64d2c4df678c1c10b1ca9d9f386e8fd6dd9afe0cb804b11b9dff736ab11 On require of this package, index.js loads polyfill.js which reconstructs attacker-controlled hostnames via array-join concatenation e.g...

Malicious code in checkout-storybook-default (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844d8b490d431f2fad501a06bbcf924fe5890ba16c92157dd52488c1908f7909 On require of the package, index.js loads polyfill.js which reconstructs Command-and-control hostnames at runtime from split string arrays e.g...

MAL-2026-12599 Malicious code in checkout-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d17ce247f3e7fa94b43e93af7597a9ae8a2a4008048a1ae8deb9352f45fc731 On require of checkout-types, index.js loads vendor.js which runs setup at top level. The code reconstructs C2 hostnames from split string arrays...

Malicious code in checkout-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d17ce247f3e7fa94b43e93af7597a9ae8a2a4008048a1ae8deb9352f45fc731 On require of checkout-types, index.js loads vendor.js which runs setup at top level. The code reconstructs C2 hostnames from split string arrays...

Malicious code in checkout-use-toasts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bed98d203bbb9cb1a915db70566cfe33eb063a59e97c1e2f7607164b5a9c312e On require of checkout-use-toasts, index.js loads bridge.js which fetches an OS/architecture-specific native binary from runtime-assembled Cloudflare...

MAL-2026-12600 Malicious code in checkout-use-boolean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074ff605503d1aeec44b6665b7e5e6c74bbaad52226135c1ad0b4c10eb676261 On require'checkout-use-boolean', index.js loads vendor.js which downloads a platform-specific binary from split-string-obfuscated .workers.dev hosts...