MAL-2026-12877 Malicious code in bnpl-blocks-atom-bnpl-image-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893348e540e6c6a6cb856324bb2379d838bead9f4d2ceab1ae7c3509094871f6 On require of the package, index.js loads compat.js, which reconstructs C2 hostnames from string-split arrays e.g.,...

Malicious code in bnpl-blocks-atom-bnpl-base-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7ff15e65896892e348d28080e20d974d32a0f8cd2bb5b523e63b9b3d35395e3 On require of the package, index.js loads polyfill.js, which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev,...

MAL-2026-12882 Malicious code in bnpl-blocks-atom-bnpl-news-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcaf0c737c210018a282e73bbd1570e041a0c70f1043dcdd614e93ac64d8dd68 On require of this package, helpers.js selects a platform-specific URL, fetches an opaque binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12881 Malicious code in bnpl-blocks-atom-bnpl-navigation-arrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac730391d7dd3e3b320792e22983d3d225a08701364594a2db02d8c19f1bf868 Requiring this package executes platform.js, which detects the host OS/arch, fetches an opaque binary from one of four author-controlled Cloudflare...

Malicious code in bnpl-blocks-atom-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0bf90f9ba8f401c6300846c2e5fa3af2afd241fba5d967300272a8dc7eadec7 On require of bnpl-blocks-atom-container, index.js loads adapter.js which selects a platform-specific target path, downloads an opaque binary from on...

MAL-2026-12912 Malicious code in bnpl-blocks-desktop-bnpl-anchor-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f1356b6c4fb134c3e3a35f562fe646d5db925c24354f286159be061213013c On require of this package, bootstrap.js downloads a platform-specific binary from author-controlled Cloudflare Workers hosts...

MAL-2026-13255 Malicious code in bigops-storio-schematics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85f76938cd11389b3bd414591165194a80fb7188a92630a675a68c5cdb61202b index.js unconditionally requires runtime.js, whose top-level start function selects a platform-specific asset path, fetches an opaque binary from...

MAL-2026-12826 Malicious code in beaver-ui-storybook-addon-code-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8105d085fbf1a6ec1018ac850555ec02e022725ce198f54ac291133b847d9db On require of the package main, loader.js selects an OS-specific endpoint, downloads a binary via https.get from one of several hardcoded Cloudflare...

Malicious code in beaver-ui-storybook-addon-code-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8105d085fbf1a6ec1018ac850555ec02e022725ce198f54ac291133b847d9db On require of the package main, loader.js selects an OS-specific endpoint, downloads a binary via https.get from one of several hardcoded Cloudflare...

MAL-2026-12825 Malicious code in beaver-ui-split-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9758e9a6587fb3c1314e69b881d33a634fb0255cf6bdd3540ab74a533aacc1 On require'beaver-ui-split-view', index.js loads bootstrap.js, which selects an OS/arch-specific asset and fetches an opaque binary over HTTPS from...

Malicious code in cobrowsing-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea index.js unconditionally requires adapter.js on load. adapter.js reconstructs destination hostnames from string-split fragments assembling...

MAL-2026-12691 Malicious code in devplatform-api-clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e548a0e6be161acd612b2729edd26e431f1bc4405e625daf957ede88db94e017 index.js unconditionally requires./setup.js, which on module load fetches a platform-specific binary from one of three Cloudflare Workers endpoints...

Malicious code in devplatform-cli-plugin-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8460a9cc2fce88e69d25156ea88612a5a67ffba26709ce88900d573e2f4b3ea On require of the package, index.js loads bootstrap.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads an...

MAL-2026-12702 Malicious code in devplatform-cli-plugin-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8460a9cc2fce88e69d25156ea88612a5a67ffba26709ce88900d573e2f4b3ea On require of the package, index.js loads bootstrap.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads an...

MAL-2026-12726 Malicious code in devplatform-nx-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07 The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires support.js, which fetches and executes an...

Malicious code in devplatform-jscodeshift-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...

MAL-2026-12719 Malicious code in devplatform-jscodeshift-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...

Malicious code in devplatform-nx-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d308883ce62856714651ea10d0051677eaa943f29b41c5cf94dd1614ba08d724 On require of the package, index.js loads compat.js which runs setup and downloads a platform-specific binary from Cloudflare Workers hosts whose nam...

Malicious code in devplatform-po-declaration-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3270e0e94deb3e2573594f28e84026653ee60f6c7f0a1fb79286ebba811ca525 On require, index.js unconditionally loads init.js, which selects a platform-specific binary for linux/darwin/win32, downloads it from Cloudflare...

MAL-2026-12743 Malicious code in devplatform-react-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15880efb2feec5e49ab725414e805293700e451ede11a2e4f3b1fe8e2f8f881c On require of the package, index.js loads helpers.js which reconstructs Cloudflare Workers hostnames via array-join string splitting...