MAL-2026-12990 Malicious code in bnpl-blocks-mobile-bnpl-grid-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 792cb2358938b5e58ee7cd132526e95184827417dd7d66c21d6e9ae281145a70 On require of the package, index.js loads runtime.js, which assembles a rotating list of C2 hostnames from array-joined string fragments resolving to...

Malicious code in bnpl-blocks-mobile-bnpl-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d66362455002e754cf596122aa451dcd28d20d3a446b5284d2be76d8db6af4cb index.js requires./setup on module load. setup.js assembles Cloudflare Workers hostnames from split string fragments oob-worker.cf99-9b3.workers.dev,...

MAL-2026-12995 Malicious code in bnpl-blocks-mobile-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36d339646cbe6f6c012c79bcb2c040941c777f5b76d67677bab4e11a3c46785d index.js unconditionally requires./setup.js when the module is loaded. setup.js selects a platform-specific payload for linuxx64, linuxarm64, darwin,...

MAL-2026-13003 Malicious code in bnpl-blocks-mobile-bnpl-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7f199feae1ae38b3dfd2c94cf56ad56ef7ef0fe4e0172a64ef76ddf401bcbcb On require of the package, index.js loads bootstrap.js which selects a platform-specific URL, downloads an executable from obfuscated Cloudflare...

Malicious code in bnpl-blocks-mobile-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e19ad8f13f3c9f4ab6b31c65bad3fb1239ad816c040504428eae8c32740869c index.js unconditionally requires helpers.js, which on module load fetches a platform-specific binary from string-split-obfuscated Cloudflare Workers...

MAL-2026-13002 Malicious code in bnpl-blocks-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a02f6576518bfc325248a8787aff66ebad12acc3e63b05fd7b35f96ffd1a62d6 The package's index.js requires runtime.js on load, which fetches a platform-specific native binary from one of three Cloudflare Workers hosts...

Malicious code in bnpl-blocks-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a02f6576518bfc325248a8787aff66ebad12acc3e63b05fd7b35f96ffd1a62d6 The package's index.js requires runtime.js on load, which fetches a platform-specific native binary from one of three Cloudflare Workers hosts...

MAL-2026-13007 Malicious code in bnpl-blocks-mobile-bnpl-tab-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34cc219a990162733e49aafc255a8abe4c4acd3fc56bce77ae31800fd4791678 On require of the package, index.js side-loads adapter.js which selects a platform-specific asset, downloads bytes over HTTPS from hostnames...

MAL-2026-13009 Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d On require of index.js, support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers...

Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d On require of index.js, support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-13018 Malicious code in bnpl-blocks-stories (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04845144f2e54662acd3413698e57b4efbbe44c47ddeb3c40c2fcc7383ae572c On require of the package, index.js loads./ext which reconstructs hardcoded hostnames via fragment-joined arrays e.g. oob-worker.cf99-9b3.workers.dev...

Malicious code in bnpl-blocks-mobile-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6a276d26c910b007ca066878179b48828a21822a3d4fb4a711604700a537f9 On require of this package, main resolves to runtime.js, which assembles Cloudflare Workers hostnames by string-splitting...

MAL-2026-13033 Malicious code in boxy-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de3d566208b48f775ec51e3308934813973ad0a6fef6cb98fd438042056bb9b0 On require of the package, index.js loads shim.js which reconstructs attacker-controlled hostnames from split-string arrays Cloudflare Workers...

MAL-2026-13031 Malicious code in boxy-bus-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6494a00553cc1e8c7e5ffdd957d31a21a33ab34a252979d7d6d551239fc0f79 On require of the package, index.js loads compat.js which downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts...

MAL-2026-13029 Malicious code in boxy-add-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8db319ad6492fd57275dc7c83a5a65815e17d2c39fb3daf395bb299742c14701 On require'boxy-add-link', index.js loads compat.js whose top-level bootstrap selects a platform-specific payload URL from string-split-obfuscated...

Malicious code in bnpl-blocks-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5570ecd44264d28f2c2378da5c6cd23e562e696687adb01ab10b373c91e6560 On require of bnpl-blocks-types, index.js loads helpers.js which selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac,...

MAL-2026-13020 Malicious code in bnpl-blocks-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5570ecd44264d28f2c2378da5c6cd23e562e696687adb01ab10b373c91e6560 On require of bnpl-blocks-types, index.js loads helpers.js which selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac,...

Malicious code in bnpl-forms-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd6e149b86406225e3aca99e9bbae44cf13c0c7d5e10be27155162b63832f2f On require'bnpl-forms-test-utils', index.js loads platform.js, which selects a platform-specific endpoint and downloads an opaque binary via https.ge...

Malicious code in boxy-docusaurus-plugin-content-docs-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 282deb7b97e943caa32f55b14ac302a247a129edb04419d744f01b62666beaae [email protected] executes a dropper on require. index.js loads ext.js, which reconstructs destination hostnames at...

MAL-2026-13041 Malicious code in boxy-docusaurus-plugin-content-docs-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 282deb7b97e943caa32f55b14ac302a247a129edb04419d744f01b62666beaae [email protected] executes a dropper on require. index.js loads ext.js, which reconstructs destination hostnames at...