Malicious code in dolyame-boxy-component-story-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c0c190f59af98fd97bf6638398afd2a774dc07593d1d954b85fd150d7ce0c32 On require of this package, support.js reconstructs Cloudflare Workers hostnames from split string fragments e.g...

MAL-2026-13302 Malicious code in dolyame-boxy-desktop-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b6f75040edc2a67f6c4912c7b8ff63ec6bd8dbd35c235bd3787ea24f52d4a2 On require/import, index.js loads./polyfill.js which selects a platform-specific endpoint, fetches bytes over HTTPS from one of several .workers.dev...

Malicious code in dolyame-boxy-desktop-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b6f75040edc2a67f6c4912c7b8ff63ec6bd8dbd35c235bd3787ea24f52d4a2 On require/import, index.js loads./polyfill.js which selects a platform-specific endpoint, fetches bytes over HTTPS from one of several .workers.dev...

Malicious code in dolyame-boxy-desktop-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626b386d1f127bc0ed973dbac051023f0f021b0be476d1cd8678802ef98c5d42 On require of the package, index.js unconditionally loads bootstrap.js, which downloads a platform-specific binary from hostnames assembled via...

MAL-2026-13306 Malicious code in dolyame-boxy-desktop-bnpl-image-plus-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4501ea4e0c044573a1d76bf04ee806de26c33bd1dc38f21a2d1f00988a96e656 On require of this package, index.js loads compat.js which selects platform-specific endpoints assembled from split string arrays e.g...

MAL-2026-13303 Malicious code in dolyame-boxy-desktop-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bdd69d6a0625e30b3c7764f12685db79bacb5c01e092772a38bbd7019addf54 Requiring dolyame-boxy-desktop-bnpl-footer causes platform.js to execute at load time: it reconstructs destination hostnames from split string arrays...

Malicious code in dolyame-boxy-desktop-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bdd69d6a0625e30b3c7764f12685db79bacb5c01e092772a38bbd7019addf54 Requiring dolyame-boxy-desktop-bnpl-footer causes platform.js to execute at load time: it reconstructs destination hostnames from split string arrays...

MAL-2026-13310 Malicious code in dolyame-boxy-desktop-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee The package main index.js requires ./init on load. init.js assembles hostnames via string-split .join'' obfuscation to produce a rotating list of...

Malicious code in dolyame-boxy-desktop-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee The package main index.js requires ./init on load. init.js assembles hostnames via string-split .join'' obfuscation to produce a rotating list of...

Malicious code in dolyame-boxy-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3 On require of dolyame-boxy-fonts, index.js unconditionally loads./loader.js, which reconstructs C2 hostnames from split-string arrays Cloudflare...

MAL-2026-13311 Malicious code in dolyame-boxy-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3 On require of dolyame-boxy-fonts, index.js unconditionally loads./loader.js, which reconstructs C2 hostnames from split-string arrays Cloudflare...

MAL-2026-13323 Malicious code in dolyame-boxy-independent-bnpl-origination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0512db79eba207153d2427271566e3ecd016d3d817266e683a801d82183254e9 On require, index.js loads ext.js which detects platform, constructs C2 hostnames by joining split string fragments e.g. "oob-worker.cf99-9b3.worker"...

Malicious code in dolyame-boxy-independent-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681 On require of the package, index.js loads vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of...

MAL-2026-13322 Malicious code in dolyame-boxy-independent-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3d08e3dbef59d66846b1b2ef0080f02c8f2c3597eb4725db3c6f62c8fcb231 index.js unconditionally requires./loader on load. loader.js selects a platform-specific payload path linuxx64, linuxarm64, darwin, win32 and downloa...

Malicious code in dolyame-boxy-independent-bnpl-main-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698 index.js unconditionally requires./bridge on load. bridge.js selects a per-platform payload linux x64/arm64, darwin, win32, fetches a native binary...

MAL-2026-13320 Malicious code in dolyame-boxy-independent-bnpl-main-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698 index.js unconditionally requires./bridge on load. bridge.js selects a per-platform payload linux x64/arm64, darwin, win32, fetches a native binary...

Malicious code in dolyame-boxy-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 373a9a2757b6b44dde0583e1cf35f5eabe8e360bf732e751630d8bb8ddb72ee6 On require of dolyame-boxy-markdown, index.js loads ext.js which downloads a platform-specific native binary from author-controlled Cloudflare Worker...

MAL-2026-13336 Malicious code in dolyame-boxy-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 373a9a2757b6b44dde0583e1cf35f5eabe8e360bf732e751630d8bb8ddb72ee6 On require of dolyame-boxy-markdown, index.js loads ext.js which downloads a platform-specific native binary from author-controlled Cloudflare Worker...

MAL-2026-13335 Malicious code in dolyame-boxy-independent-bnpl-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3490fd11839adb1f5027facaf8046cd19e640fffdbf79d0684c91a565dd8303 On require of the package's main entry, index.js loads adapter.js which performs OS/arch detection and fetches an opaque binary from...

Malicious code in dolyame-boxy-independent-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 273880296b11c362e48b0d7b6d2795c56f8726937482462bee9e615943572d46 On load, index.js unconditionally requires platform.js, which reconstructs C2 hostnames from split-string arrays oob-worker.cf.workers.dev with...