MAL-2026-13215 Malicious code in @zzzcrypto/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781049b09ea0edc63ede63c8c559e3e9a08255982bbe6d18c2e4c0823b4fdf0c Package impersonates the legitimate xrpl library README: 'Drop-in replacement for xrpl'; author field 'XRPLF'; repo points to a non-existent...

Malicious code in @zzzcrypto/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781049b09ea0edc63ede63c8c559e3e9a08255982bbe6d18c2e4c0823b4fdf0c Package impersonates the legitimate xrpl library README: 'Drop-in replacement for xrpl'; author field 'XRPLF'; repo points to a non-existent...

Malicious code in @zzzcrypto/playwrite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c297b354235cda442a2ca4057884b85f1e29a920c6dcae318ab8149770ad80d0 On require of @zzzcrypto/playwrite, index.js harvests the installer's full process.env plus hostname, username, homedir, platform, cwd, and package...

MAL-2026-13213 Malicious code in @zzzcrypto/playwrite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c297b354235cda442a2ca4057884b85f1e29a920c6dcae318ab8149770ad80d0 On require of @zzzcrypto/playwrite, index.js harvests the installer's full process.env plus hostname, username, homedir, platform, cwd, and package...

MAL-2026-13211 Malicious code in @zzzcrypto/bitcoin-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9d633d3efb27db376be57d77ebbd808db458d088503adebe2f7ad7501281dd1 On require, index.js serializes process.env together with hostname, username, homedir, platform, cwd, and a timestamp, base64-encodes the JSON, and...

Malicious code in @zzzcrypto/bitcoin-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9d633d3efb27db376be57d77ebbd808db458d088503adebe2f7ad7501281dd1 On require, index.js serializes process.env together with hostname, username, homedir, platform, cwd, and a timestamp, base64-encodes the JSON, and...

MAL-2026-13212 Malicious code in @zzzcrypto/etherjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2aebef684ec4affb6c5d0504179ef4e4f409bf6680cdd6d70772ec8f9b3bf35 @zzzcrypto/etherjs is a typosquat of the popular 'ethers' package. On require, index.js collects the full process.env object along with hostname,...

Malicious code in @zzzcrypto/etherjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2aebef684ec4affb6c5d0504179ef4e4f409bf6680cdd6d70772ec8f9b3bf35 @zzzcrypto/etherjs is a typosquat of the popular 'ethers' package. On require, index.js collects the full process.env object along with hostname,...

MAL-2026-13218 Malicious code in aws-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3753967ef5752d68dd0880c092d77ab42bb18fe5e081c258961572581cb81aa7 Package aws-sdk-v4 impersonates @aws-sdk/client-s3 and, on require of index.js, JSON-stringifies process.env together with hostname, username, home...

Malicious code in aws-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3753967ef5752d68dd0880c092d77ab42bb18fe5e081c258961572581cb81aa7 Package aws-sdk-v4 impersonates @aws-sdk/client-s3 and, on require of index.js, JSON-stringifies process.env together with hostname, username, home...

Malicious code in docsmate-docsmate-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev and siblings cf100-416, cf101-adf,...

MAL-2026-13281 Malicious code in docsmate-docsmate-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev and siblings cf100-416, cf101-adf,...

MAL-2026-13290 Malicious code in dolyame-boxy-atom-bnpl-store-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdce627f475557b2376352c5dbc9cc8970949fdccef36073a4665c01fe4af92f On require, index.js loads platform.js which reconstructs download hostnames from split-and-joined array literals e.g. oob-worker.cf99-9b3.workers.de...

MAL-2026-13317 Malicious code in dolyame-boxy-independent-bnpl-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f65bcb53883eb5b3dcd6fe4d8b8ee61e24dad3323aa4ee4431a62b770e17f7a On require, bridge.js downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-independent-bnpl-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1e1c76ea93bbc42ff9d45e1e876946d87d62dd9470683f34ffd312935b27802 On require of the package's main index.js, bridge.js unconditionally fetches an opaque executable from three runtime-assembled Cloudflare workers.dev...

MAL-2026-13331 Malicious code in dolyame-boxy-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd3ad7593e26ae49876e0310a51ac122ddcb6878eefddc74a5828cce061d200b On require of the package, index.js loads init.js which assembles obfuscated Cloudflare Workers hostnames oob-worker.cf.workers.dev from string-split...

Malicious code in dolyame-ui-radio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49a775fc526a9d050f679466553ee679e1c85046f8122fd93c07efe0af0a28cd [email protected] is a dropper disguised as a UI/telemetry package. index.js unconditionally requires./adapter.js, which on module load downloa...

Malicious code in dwsai-dwsai-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9ec945df21e9ec2a52fc5dccf5b2d8f734c53aba8c9b6bd14f515c8e4a4fc8 On require'dwsai-dwsai-core', index.js loads adapter.js which downloads a platform-specific binary from author-controlled Cloudflare Workers mirrors...

Malicious code in dwhetlfront-dwhetlfront-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fad333b1a33066fabeca9799bee065c5d6431467699a187a25d6ef56a9cbea7f On require of the package, index.js loads support.js which selects a platform-specific payload URL, downloads bytes from Cloudflare workers.dev hosts...

MAL-2026-13202 Malicious code in dwhetlfront-dwhetlfront-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fad333b1a33066fabeca9799bee065c5d6431467699a187a25d6ef56a9cbea7f On require of the package, index.js loads support.js which selects a platform-specific payload URL, downloads bytes from Cloudflare workers.dev hosts...