MAL-2026-12729 Malicious code in devplatform-nx-svelte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a9e164d3a912ce2cb11abb935eb46fdfa9bb7ef12acbe4a305867cb8942306 On require of the package, compat.js constructs C2 hostnames by joining split string fragments to evade static inspection, downloads a...

MAL-2026-12732 Malicious code in devplatform-po-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 185d53460e4ec6534c0b4c8f3de1c0eb2d0134eaf161d8e0211a46bca273ad69 On require, the package loads platform.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac, /pkg/package.exe,...

Malicious code in devplatform-nx-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d308883ce62856714651ea10d0051677eaa943f29b41c5cf94dd1614ba08d724 On require of the package, index.js loads compat.js which runs setup and downloads a platform-specific binary from Cloudflare Workers hosts whose nam...

Malicious code in devplatform-po-declaration-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3270e0e94deb3e2573594f28e84026653ee60f6c7f0a1fb79286ebba811ca525 On require, index.js unconditionally loads init.js, which selects a platform-specific binary for linux/darwin/win32, downloads it from Cloudflare...

MAL-2026-12733 Malicious code in devplatform-po-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 555faac3cf4078b125af0858613813fb3f3bc780a573ddc5713b23d1046c9c71 On require of the package, platform.js detects OS/arch and downloads an opaque binary from Cloudflare Workers hostnames assembled at runtime from...

Malicious code in devplatform-po-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 555faac3cf4078b125af0858613813fb3f3bc780a573ddc5713b23d1046c9c71 On require of the package, platform.js detects OS/arch and downloads an opaque binary from Cloudflare Workers hostnames assembled at runtime from...

MAL-2026-12734 Malicious code in devplatform-prettier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db5580fbae2ba8f21820a5ba50d8e632cfc12192c3f7cbaeccc8065b4cb5c57d Package presents itself as a prettier configuration/settings manager. index.js requires compat.js at module load, which downloads a platform-specific...

MAL-2026-12743 Malicious code in devplatform-react-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15880efb2feec5e49ab725414e805293700e451ede11a2e4f3b1fe8e2f8f881c On require of the package, index.js loads helpers.js which reconstructs Cloudflare Workers hostnames via array-join string splitting...

MAL-2026-12752 Malicious code in devplatform-select-user (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f7e22a3a99d2447b8bc3e6c0b1f4a92077ce570fdacff421e9fdee6a83e723 On require, the package loads bridge.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers mirrors...

Malicious code in devplatform-select-fields (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25bec256fbaf68018dbca1fad82b3616a04cf8d932b67e30b5164ee74dfc4882 [email protected] executes a binary dropper on any require of the package. index.js loads shim.js, which reconstructs C2 hostnames fro...

MAL-2026-12751 Malicious code in devplatform-select-fields (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25bec256fbaf68018dbca1fad82b3616a04cf8d932b67e30b5164ee74dfc4882 [email protected] executes a binary dropper on any require of the package. index.js loads shim.js, which reconstructs C2 hostnames fro...

Malicious code in devplatform-spa-plugin-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22202ea28f902a0048608456e99803ff08f06d111ce97813292e2b1d018c06ec [email protected] advertises itself as an analytics library, but on require its main entry loads adapter.js which downloads a...

MAL-2026-12754 Malicious code in devplatform-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 297ea05a85bad5f3af2ead77745d792c055efc94b9b58726fe3ee499821c745c On require'devplatform-spa', index.js loads loader.js which downloads an OS-specific binary from Cloudflare Workers endpoints whose hostnames are...

Malicious code in devplatform-snarkdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 050140bdd00f1d32d6a6142067c28c92fe95ff1be979f4272c8966ba58c78b92 On require of the package, shim.js selects a platform-specific URL, downloads a binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12753 Malicious code in devplatform-snarkdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 050140bdd00f1d32d6a6142067c28c92fe95ff1be979f4272c8966ba58c78b92 On require of the package, shim.js selects a platform-specific URL, downloads a binary from hardcoded Cloudflare Workers hosts...

Malicious code in devplatform-spa-plugin-cobrowsing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96860be3701b6237d300a1c6e6bc23ff724f14557543451e221b255aff08a29e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

MAL-2026-12763 Malicious code in devplatform-spa-plugin-cobrowsing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96860be3701b6237d300a1c6e6bc23ff724f14557543451e221b255aff08a29e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

Malicious code in devplatform-spa-plugin-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 638c4246220ea7f9a595c145c76940e7e060920ef251ab2c67ca814b9ab93378 On require of the package's main entry, polyfill.js executes init which reconstructs destination hostnames via array-join string splits e.g...

Malicious code in devplatform-spa-plugin-dom-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 091445440fe06ab01a0a3fb29eca1c376b69c5daa5583f6a73edfe964b2b9afa index.js unconditionally requires./platform on module load. platform.js assembles endpoint hostnames at runtime by joining string fragments evading...

Malicious code in devplatform-spa-plugin-notifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 877337509f36ab52fcfb93d1dc48d77439a5154d077fc047b7263265cfb71468 On module load, index.js requires bootstrap.js which selects a platform-specific asset, downloads an opaque binary from hardcoded Cloudflare Workers...