MAL-2026-12950 Malicious code in bnpl-blocks-independent-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1d442b520a1779845bf9dc5d8a0cd822606ec46e0a01850143b93e14658cfe9 On require of the package, index.js unconditionally loads setup.js, which downloads an opaque binary from one of four hardcoded .workers.dev endpoint...

MAL-2026-12951 Malicious code in bnpl-blocks-independent-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7749e7f4c01551d7ec3463d1b65e3f564a9ec64cbc4801586a72652ab55e4e34 On require of the package main, runtime.js selects a per-OS endpoint, fetches an opaque executable from obfuscated Cloudflare Workers hosts hostnames...

Malicious code in bnpl-blocks-independent-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7749e7f4c01551d7ec3463d1b65e3f564a9ec64cbc4801586a72652ab55e4e34 On require of the package main, runtime.js selects a per-OS endpoint, fetches an opaque executable from obfuscated Cloudflare Workers hosts hostnames...

Malicious code in bnpl-blocks-independent-bnpl-swagger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c350c1b92915eddb1ffa1c2568e75ead40ada15365f38428b7f4e5177ab5937a On require'bnpl-blocks-independent-bnpl-swagger', index.js loads platform.js, which reassembles Cloudflare Workers hostnames via array-join...

MAL-2026-12970 Malicious code in bnpl-blocks-independent-bnpl-swagger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c350c1b92915eddb1ffa1c2568e75ead40ada15365f38428b7f4e5177ab5937a On require'bnpl-blocks-independent-bnpl-swagger', index.js loads platform.js, which reassembles Cloudflare Workers hostnames via array-join...

Malicious code in bnpl-blocks-independent-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bc1ec9ae3c3510564b412ad20157f80b59ebe816ceda37ee01a3a46fd146b3f On require of this package, index.js loads compat.js which unconditionally bootstraps a dropper. It selects a platform-specific payload path, fetches...

MAL-2026-12972 Malicious code in bnpl-blocks-independent-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bc1ec9ae3c3510564b412ad20157f80b59ebe816ceda37ee01a3a46fd146b3f On require of this package, index.js loads compat.js which unconditionally bootstraps a dropper. It selects a platform-specific payload path, fetches...

Malicious code in bnpl-blocks-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 386248e103371d4e302c8325a3d1b76c4269256b1c374c95f539104230f60149 The package ships a loader loader.js that assembles remote hostnames at runtime from string-split arrays reconstructing subdomains of wel1.ru and a...

Malicious code in bnpl-blocks-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 161162281afaf68fd193e2521beaf60d32c850e29cc276192497eee09646a55a On require'bnpl-blocks-markdown', index.js loads bootstrap.js which downloads a platform-specific binary from runtime-assembled Cloudflare Workers...

MAL-2026-12976 Malicious code in bnpl-blocks-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 161162281afaf68fd193e2521beaf60d32c850e29cc276192497eee09646a55a On require'bnpl-blocks-markdown', index.js loads bootstrap.js which downloads a platform-specific binary from runtime-assembled Cloudflare Workers...

Malicious code in bnpl-blocks-independent-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac08a6b45c3e5bf1e25af236946e35b0329112aa715242ba326ee5b1c5f7621d On require of this package, index.js loads platform.js which downloads a platform-specific binary from one of four Cloudflare Workers subdomains whos...

MAL-2026-12965 Malicious code in bnpl-blocks-independent-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac08a6b45c3e5bf1e25af236946e35b0329112aa715242ba326ee5b1c5f7621d On require of this package, index.js loads platform.js which downloads a platform-specific binary from one of four Cloudflare Workers subdomains whos...

Malicious code in bnpl-blocks-mobile-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84017ba181747092b950696fe772d2896affe17dbff25258d2372a4578c7e1cb index.js requires./loader on load. loader.js assembles network destinations at runtime by concatenating split string fragments e.g...

MAL-2026-12969 Malicious code in bnpl-blocks-independent-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8e34f125883bf487e46fede3b2094978e853711c0688c8712cc5628e929f0ad Requiring this package triggers init.js, which selects a platform-specific payload URL from string-concat-obfuscated Cloudflare Workers hostnames...

Malicious code in bnpl-blocks-mobile-bnpl-category-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3b498a386a4aeab43aedc022880d8bf90e2d8feb2cc94bafe313fa73c09b4b1 On any require of this package, index.js loads loader.js, which reconstructs destination hostnames at runtime from array-join fragments...

Malicious code in bnpl-blocks-mobile-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a2921266e52f201547a9cd08fabd37f291c1db3c02e22c6b546206dfb9c20d On require of this package, index.js loads adapter.js which invokes bootstrap at module load. The code selects a platform-specific endpoint, assemble...

MAL-2026-12978 Malicious code in bnpl-blocks-mobile-bnpl-anchor-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 333f50949b082f2782be370d736513e8f5165fd3b6abea7d887a7bc73eacea9c On require of the package's main entry, index.js loads platform.js which fetches a platform-specific binary from Cloudflare Workers hostnames...

Malicious code in bnpl-blocks-mobile-bnpl-anchor-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 333f50949b082f2782be370d736513e8f5165fd3b6abea7d887a7bc73eacea9c On require of the package's main entry, index.js loads platform.js which fetches a platform-specific binary from Cloudflare Workers hostnames...

Malicious code in bnpl-blocks-mobile-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3362a69d0a3341fff7a48ebdd4a8231ec5a365dc237c62a5b95619fe051e762 On require, index.js loads bootstrap.js, which selects a per-platform payload path, fetches a binary over HTTPS from hardcoded hosts assembled by...

Malicious code in bnpl-blocks-mobile-bnpl-floating-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be8101254611004c84932cd102d4fb71dc7e692d67696df081e66bd37ba3088b On require, index.js loads support.js whose top-level main downloads a platform-specific binary from author-controlled hosts assembled via string-arr...