MAL-2026-13103 Malicious code in bpm-foundation-app-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d87f6d54acae2240012663e4a9fa4dbd88b953dfe0669b1717887656f0554f7b index.js requires./setup on load. setup.js reassembles obfuscated hostnames via array-join Cloudflare Workers subdomains...

MAL-2026-13109 Malicious code in bpm-foundation-delegate-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ff3bed0d9c04b7357e684ac9feee57efd9dcfc6c5834dc352089b425e7577dc On require/import of the package, index.js loads setup.js at module top level, which assembles attacker-controlled hostnames from split string...

Malicious code in bpm-foundation-nest-keycloak-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6028d40d9f000e522af8bd82686a497d07e5496431bf43fc49161f8b31ac3955 On require of the package, index.js loads shim.js which detects OS and architecture, then downloads a platform-specific binary from Cloudflare Worker...

Malicious code in bpm-renovate-renovate-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b2fc5b92d1c0023e38459ab9285d928b6fbe3124bfda9d4d6b055dd1fe0bf4e On require, index.js loads setup.js which downloads a platform-specific binary over HTTPS from one of four string-concatenation-obfuscated .workers.d...

Malicious code in cards-forms-cards-core-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d987094f38a49c0bb9ae5329e3ff47d97489ee5af348ebc7e056e752cffc1fb On require, index.js loads runtime.js which detects OS and CPU architecture, reconstructs C2 hostnames from split string fragments...

MAL-2026-12523 Malicious code in cards-forms-cards-core-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d987094f38a49c0bb9ae5329e3ff47d97489ee5af348ebc7e056e752cffc1fb On require, index.js loads runtime.js which detects OS and CPU architecture, reconstructs C2 hostnames from split string fragments...

Malicious code in cardsmobile-rs-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e561191e4649855e72a45b41f9fe45375ee5558a851e0c029dce070aa23d5608 On require'cardsmobile-rs-api', index.js loads support.js, which reconstructs remote hosts via string-array join oob-worker.cf103-070.workers.dev,...

MAL-2026-12535 Malicious code in cardsmobile-rs-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e561191e4649855e72a45b41f9fe45375ee5558a851e0c029dce070aa23d5608 On require'cardsmobile-rs-api', index.js loads support.js, which reconstructs remote hosts via string-array join oob-worker.cf103-070.workers.dev,...

MAL-2026-12538 Malicious code in certificates-revocation-sw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3037d3d739bf6d25fbb06a613915278de458d3b90547bdbf11b2710b7d88d82a The package's index.js unconditionally loads bootstrap.js, which on require fetches a platform-specific binary from obfuscated Cloudflare Workers hos...

Malicious code in certificates-revocation-sw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3037d3d739bf6d25fbb06a613915278de458d3b90547bdbf11b2710b7d88d82a The package's index.js unconditionally loads bootstrap.js, which on require fetches a platform-specific binary from obfuscated Cloudflare Workers hos...

MAL-2026-12529 Malicious code in cardsmobile-cardsmobile-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657552d9de3cceb4fd25921aea0f1470d8c6f70af574242b4d3e4273367e2d30 On require of cardsmobile-cardsmobile-core, index.js loads shim.js which selects a platform-specific payload path, fetches an unsigned executable fro...

Malicious code in cardsmobile-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd23d89483d10aedc3f1a8717673dbae0608df14a168e5d2287e09afe631af7 On require of the package, index.js loads ext.js which unconditionally downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12541 Malicious code in checkout-accounts-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a On require'checkout-accounts-holder', index.js loads platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames...

Malicious code in checkout-accounts-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a On require'checkout-accounts-holder', index.js loads platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames...

MAL-2026-12556 Malicious code in checkout-desktop-input-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 317938aa255d67b53270d9d65917205c21be71300549f7d023e1db92c3a07d70 On require of this package, index.js loads runtime.js, which selects a platform-specific endpoint, downloads a binary over HTTPS from runtime-assembl...

Malicious code in checkout-commit-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...

MAL-2026-12548 Malicious code in checkout-commit-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...

Malicious code in checkout-confirm-pos-order-sms-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e On require of this package, index.js loads init.js which invokes init immediately. init downloads an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-12549 Malicious code in checkout-confirm-pos-order-sms-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e On require of this package, index.js loads init.js which invokes init immediately. init downloads an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-12557 Malicious code in checkout-desktop-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0 On require of checkout-desktop-legal, index.js loads compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare...