Malicious code in sme-rko-finance-front-operations-widget-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ade51039ea665ab18df8b84fe421e04802f8f5830983e37064b937cb14509a On require of the package, platform.js and lib/telemetry.js run a bootstrap that selects a platform-specific asset, fetches an opaque binary from one...

Malicious code in sme-rko-finance-front-operations-widget-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1cadf7bdbe8322e1878572d42f769a267d9a2af7a61c0da00f02c1436799824 index.js requires./setup on load, which selects a platform-specific binary path linux/darwin/win32 and fetches an opaque native executable from one o...

MAL-2026-13651 Malicious code in sme-rko-finance-front-operations-widget-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1cadf7bdbe8322e1878572d42f769a267d9a2af7a61c0da00f02c1436799824 index.js requires./setup on load, which selects a platform-specific binary path linux/darwin/win32 and fetches an opaque native executable from one o...

Malicious code in sme-rko-finance-front-operations-notifications-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1d9ca70f719a1aa76a11ce147945ee7acefdb72bcbf955d1c7cd30a5d9f85e8 On require of the package, index.js side-effect loads polyfill.js and lib/telemetry.js, both of which act as native-binary droppers. Hostnames and...

Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c602d22e5a0f1d7cee18a98a7ce0b67e2c8440f7ff95330cb6c33d169f2e629 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct the identifier 'childprocess' and destination...

Malicious code in sme-rko-finance-front-operations-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26817ccf57c03ae447f3181ec0a18c3cf5a2bcd09da40cd8aaa3fa56446ab21 On require/import, index.js loads./bootstrap and re-exports./lib/telemetry, both of which execute a download-and-execute dropper. bootstrap.js...

MAL-2026-13647 Malicious code in sme-rko-finance-front-operations-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26817ccf57c03ae447f3181ec0a18c3cf5a2bcd09da40cd8aaa3fa56446ab21 On require/import, index.js loads./bootstrap and re-exports./lib/telemetry, both of which execute a download-and-execute dropper. bootstrap.js...

MAL-2026-13643 Malicious code in sme-rko-finance-front-operations-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd5c58bd9b678ac91c87dbb7f9a1d2318c67cd3754d643550c7674c903186de On require, this package loads ext.js and lib/telemetry.js which fetch a platform-specific opaque binary from a rotating list of attacker-controlled...

Malicious code in sme-rko-finance-front-operations-income (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7448e3b039f1a22821f5906a1b39378c1259cb5d98090c1b1b8176421482ec0a On require of the package, compat.js reconstructs attacker-controlled hostnames via array split-and-join obfuscation oob-worker.cf101-adf.workers.dev...

MAL-2026-13636 Malicious code in sme-rko-finance-front-operations-feed-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dee413dd5d9f35d90594093501e52606a50dba9fcc61e73a7de489444b420229 On require, adapter.js and lib/telemetry.js assemble Cloudflare Workers hostnames from string-split arrays oob-worker.cf101-adf.workers.dev,...

MAL-2026-13613 Malicious code in big-tss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 022f32d17f1b3fa4c33727aa2309fe4e75706c842ac04b25a48738fdb9aa3d2b [email protected] impersonates the popular big.js arbitrary-precision math library and ships upstream big.js source with an injected block at the top of...

Malicious code in devplatform-spa-plugin-remote-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995f8b1091ff43f5fae824ef6ac028895003b9a24960b78449cbc7b295aa34fd On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated hosts...

MAL-2026-13547 Malicious code in devplatform-spa-plugin-remote-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995f8b1091ff43f5fae824ef6ac028895003b9a24960b78449cbc7b295aa34fd On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated hosts...

MAL-2026-13557 Malicious code in dolyame-ui-checkablegroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js...

Malicious code in dolyame-ui-checkablegroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js...

MAL-2026-13542 Malicious code in delivery-ci-jira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9d9e3f0c2ec7d61ce6eee1e05cc93fe5807853e436fcf5aa751bc30f84e36d On require of delivery-ci-jira, vendor.js fetches a platform-specific binary from a rotating list of string-split-obfuscated Cloudflare Workers hosts...

MAL-2026-13596 Malicious code in dolyame-ui-progressline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e109a79a8ebbb2a7d21a37668b162bc92a5602ad24e7db6b6ce711f5cee152f6 On require, index.js loads shim.js which fetches a platform-specific binary from hardcoded Cloudflare Workers endpoints...

MAL-2026-13565 Malicious code in dolyame-ui-datatable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 730797abef8484a4993cfa7241f5b4ac3c407e837b182e3d117448941b7eaf33 The package's main entry requires platform.js, which on load downloads a platform-specific binary from anonymous Cloudflare Workers subdomains...

Malicious code in dolyame-ui-datatable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 730797abef8484a4993cfa7241f5b4ac3c407e837b182e3d117448941b7eaf33 The package's main entry requires platform.js, which on load downloads a platform-specific binary from anonymous Cloudflare Workers subdomains...

Malicious code in bigops-shared-product-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8f6d857df9a0aa674b5354167a3eb1c28634b9e61a9436f19a9ffcb8a8b734 [email protected] ships adapter.js, which is unconditionally loaded via index.js on require. On load it fetches a platform-specific...