MAL-2026-13322 Malicious code in dolyame-boxy-independent-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3d08e3dbef59d66846b1b2ef0080f02c8f2c3597eb4725db3c6f62c8fcb231 index.js unconditionally requires./loader on load. loader.js selects a platform-specific payload path linuxx64, linuxarm64, darwin, win32 and downloa...

Malicious code in dolyame-boxy-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32273cf2b594fbdf7b09058c383c7d40319001732490771eda7931aaf01bf451 On require'dolyame-boxy-scroll', index.js loads ext.js which selects a platform-specific path linux/darwin/win32, downloads a binary from one of thre...

Malicious code in dolyame-ui-codemods (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa4592f76ef0995b4e3c8b0cc15c00862cf594cbaebbfcd2bf25d2640bbf6012 On require'dolyame-ui-codemods', index.js loads polyfill.js, which reconstructs remote hostnames from split string-fragment arrays joined at runtime...

MAL-2026-13151 Malicious code in dolyame-ui-draggable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81324df09668ea22833f1cff69d3e861bbb0644e5f231028ef2ea8ba0f9b8631 The package advertises itself as a UI toolkit, but its main entry requires./runtime.js, which on load downloads a platform-specific binary from...

MAL-2026-13171 Malicious code in dolyame-ui-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27d450fda6c199002bb4eb20b3bf624e31393ae3ed30e9a36fce17507472b962 Package advertises itself as a UI notification toolkit but its main entry requires./compat.js, which on load randomly selects a destination from four...

Malicious code in dolyame-ui-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba7c3d2ae4bea9c6638aa21727d88df65e96361021b4c5d458eac472191c0e86 On require'dolyame-ui-slider', index.js loads bootstrap.js which selects a platform-specific asset path, downloads an opaque binary from one of three...

Malicious code in dolyame-ui-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c154e71b3fe4bf6957b180aa41ecdc789c11ea90928aab8c66c52a90c6428051 On require of the package's main entry, index.js loads platform.js which assembles obfuscated hostnames via array.join"" to reach...

Malicious code in dolyame-ui-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9a2d0e912bed4c7005a9945215406319204611c186b19d77065d1a5216e5fb1 Requiring the package loads ext.js, which downloads a platform-specific binary from obfuscated .workers.dev endpoints with a DNS-TXT base64 fallback...

MAL-2026-13201 Malicious code in dp-web-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec4c10894526621b93c3dba8f579e76be53db3989ab0ddb32c72bff180266786 The package advertises itself as a web header library but its index.js unconditionally requires ext.js on load. ext.js downloads a platform-specific...

Malicious code in devplatform-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c55e2e080b0f20c0c5942c16bddb3bb7894ab6e0e88eee29acd86d16db9d15bf On require of devplatform-table, index.js loads./compat which selects a platform-specific payload path, downloads an executable from...

MAL-2026-12824 Malicious code in beaver-ui-smart-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9aeae07ad8c21acdd73d30a24723d30ef468f03a3412e21ea4bf726f27c2f12 The package is advertised as a React UI filter component but on require of index.js loads adapter.js, which assembles remote hostnames from split...

Malicious code in bigops-api-customer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41f35d0e9c1c32b6937135731889f5494483108bf0cf449fc19e5b4cecc4a002 On require of bigops-api-customer, index.js loads compat.js which downloads an OS-specific native binary from obfuscated Cloudflare Workers hosts...

Malicious code in bigops-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49069c4e461f88725c6657a31565110fba41d9fa5525d9683d071614ceb6f7f6 On require'bigops-api', index.js loads compat.js which detects OS/arch, downloads a platform-specific binary from runtime-assembled hostnames fragmen...

MAL-2026-12841 Malicious code in bigops-telephony-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98fd12faa59a5e65d0383cfb3be55ccd49beca5c74cb350b62f5717be83bcd65 On require of bigops-telephony-client, index.js loads./runtime.js, which unconditionally downloads a platform-specific binary over HTTPS from...

Malicious code in bnpl-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eda2ee8ac0f1ffdce814e7ca4bb7e1c1ca52beebb7048b18a64d8e13e87abf4 The package presents itself as an empty API stub index.js exports a no-op BnplApi and unconditionally require"./support" on load. support.js assemble...

Malicious code in bnpl-blocks-atom-bnpl-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e57d88037b98733cb7376fa7fa11e80d1d6eb6f9373a7d6e1b555e96039b3abe On require of the package, index.js unconditionally loads polyfill.js, which downloads a platform-specific binary from one of three obfuscated...

MAL-2026-12879 Malicious code in bnpl-blocks-atom-bnpl-integrations-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2708bb1921034553386778769eccfeb8858cc65d8890b438cb7dc07bfb1eb60 On require, the package's main entry loads ext.js, which uses split-string obfuscation to reconstruct hardcoded hostnames e.g...

Malicious code in bnpl-blocks-atom-icon-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de37ae50b4a6878a2719938fddc4c705e82cbbc33d3d85dbe59462d91f0d53c5 On require of the package, index.js unconditionally loads compat.js, which selects a platform-specific output path Linux/Darwin: /tmp/.cache; Windows...

Malicious code in bnpl-blocks-desktop-bnpl-anchor-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f1356b6c4fb134c3e3a35f562fe646d5db925c24354f286159be061213013c On require of this package, bootstrap.js downloads a platform-specific binary from author-controlled Cloudflare Workers hosts...

Malicious code in bnpl-blocks-mobile-bnpl-article-author (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d867d807ef1166d65944d4f860b0cd74fe9d6da956c460542b0430b4fae66bd On require of the package, index.js loads shim.js which reconstructs a set of Cloudflare Workers hostnames...