Malicious code in boxy-legacy-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8102d4aaa8c2a93380336ea524f83a3025cd00c71104060245f2143ba1b2694e On require of the package's main entry, index.js loads shim.js which unconditionally executes a dropper: it selects a platform-specific payload,...

MAL-2026-13050 Malicious code in boxy-global-modules-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce609c23d8c990c21c16692270dbb62589c6f63e716994c31e5ed4f466dcad7 On require of the package's main entry, loader.js immediately fetches a platform-specific opaque binary over HTTPS from hardcoded Cloudflare Workers...

MAL-2026-13058 Malicious code in boxy-maker-bus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8e609c87c0dbbf2a870faf3c1e8ea2b322b32d147974f4ec62c400fd026744a [email protected] acts as a load-time dropper. The package's index.js unconditionally requires compat.js on load, which assembles Cloudflare...

Malicious code in boxy-maker-bus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8e609c87c0dbbf2a870faf3c1e8ea2b322b32d147974f4ec62c400fd026744a [email protected] acts as a load-time dropper. The package's index.js unconditionally requires compat.js on load, which assembles Cloudflare...

Malicious code in boxy-micro-story (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99c59fb669f0608d2c5f3362289aa05a77d09106393fd5370c207509878fe96f On require of the package, index.js loads platform.js which auto-executes an init routine that selects a platform-specific payload, fetches an opaque...

Malicious code in boxy-maker-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a06d379928c2633009c8dc7d89921205689ffb6ed8fa03ba74f67f557836c6f4 [email protected] executes a remote binary dropper the moment the module is loaded. index.js unconditionally requires polyfill.js, which selec...

MAL-2026-13063 Malicious code in boxy-maker-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a06d379928c2633009c8dc7d89921205689ffb6ed8fa03ba74f67f557836c6f4 [email protected] executes a remote binary dropper the moment the module is loaded. index.js unconditionally requires polyfill.js, which selec...

MAL-2026-13068 Malicious code in boxy-mif-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4e9fe90e4c6a7334c75fffb7bd07fdeb785a35b9fc2c1a9e5ce74265296d1c7 On require of this package, index.js loads bridge.js which downloads a platform-specific native executable from string-split obfuscated Cloudflare...

Malicious code in boxy-mmb-deps-pvm-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 088639f9b19ce8234cef116c0250628c6894bd509915aa90639c56436ec19646 index.js unconditionally loads polyfill.js on require. polyfill.js reconstructs attacker-controlled hostnames from split string literals...

MAL-2026-13076 Malicious code in boxy-pkg-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae99d3d2f9b6c2a5a47e8edd34fb78968ffc58c3a514e04ad10b14455d7436f2 index.js unconditionally loads support.js on require. support.js reconstructs Cloudflare Workers hostnames oob-worker.cf100,1,2-.workers.dev and a.ru...

Malicious code in boxy-test-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b9bbda2467ea797cb846a04b6a8c3bb71b3cfed619f7688f533050fa2f51eb [email protected] executes a remote binary dropper on any require of the package. index.js unconditionally loads bootstrap.js, which downloads a...

MAL-2026-13090 Malicious code in boxy-test-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b9bbda2467ea797cb846a04b6a8c3bb71b3cfed619f7688f533050fa2f51eb [email protected] executes a remote binary dropper on any require of the package. index.js unconditionally loads bootstrap.js, which downloads a...

Malicious code in boxy-validate-implicit-deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04288ec5388fa5634c253b28690e3e5b4b1220fbc9d07440fbb1c8a70860b0e5 On require of the package, index.js loads loader.js which selects a per-platform payload path and fetches an opaque binary from one of four hardcoded...

Malicious code in boxy-semver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec5b3e90530b4252cc04b1cf4cf70ec0113fa36f307ef33b28c80ff72ebdc83 index.js unconditionally requires./init on load. init.js downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts...

MAL-2026-13081 Malicious code in boxy-semver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec5b3e90530b4252cc04b1cf4cf70ec0113fa36f307ef33b28c80ff72ebdc83 index.js unconditionally requires./init on load. init.js downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts...

Malicious code in bpm-foundation-ai-assistant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f246c1580a9d0a9035c63c1781c411db9cae7a812f175f6b7ad18a3f2336aa index.js unconditionally requires./loader on package load. loader.js assembles Cloudflare Workers hostnames from string-array joins...

Malicious code in boxy-wrapper-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50 The package's main entrypoint index.js unconditionally requires./compat.js, whose top-level main reconstructs obfuscated Cloudflare Workers hosts...

MAL-2026-13099 Malicious code in boxy-wrapper-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50 The package's main entrypoint index.js unconditionally requires./compat.js, whose top-level main reconstructs obfuscated Cloudflare Workers hosts...

MAL-2026-13106 Malicious code in bpm-foundation-bundle-optimization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfdca3178e2278bbc76607ff9bf6ee6a3b0d2d60db7281a231288f442a1fb616 Requiring this package triggers vendor.js, which reconstructs Cloudflare Workers hostnames oob-worker.cf10.workers.dev and DNS-fallback domains...

Malicious code in bpm-foundation-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39a9ca2287ec8bbf000796cf1f41fbc088f7d8a3a37cd8d8eadc970cf19abc91 On require'bpm-foundation-common', index.js loads loader.js which assembles C2 hostnames via runtime string-joining e.g...