Malicious code in delivery-ci-microforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffef831e876b8114ebfd6559d38f34d2c559dd42263845899e45ee621aa15c7 On require'delivery-ci-microforms', index.js loads support.js which selects a platform-specific endpoint whose hostname is reassembled at runtime fro...

MAL-2026-12717 Malicious code in devplatform-jscodeshift-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92dcd946aaaf9b57795f9a94877df34a69ac39828620c58e2cf4b72cd7a9c253 On require, index.js loads loader.js, which reconstructs Cloudflare Workers hostnames from split string fragments e.g...

Malicious code in devplatform-react-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b482d551faa8ecb3cb337bd8bacfe5ec193f1bc2cad69b3998e935fbaf413efa The package's index.js requires./init on load. init.js reconstructs Cloudflare Workers hostnames via split-and-join obfuscation...

MAL-2026-12738 Malicious code in devplatform-react-query-clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 192681d10673d935bcba617102ed5581cc928ba8ebedda203cebe5d33d7f067a On require of the package, index.js loads adapter.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints...

MAL-2026-12764 Malicious code in devplatform-spa-plugin-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9000b7892808e2b10e702cb2b6f91fc672ad1bc0f58dfdc4c9cf2aa97edff896 On require of the package's main entry, support.js runs an init routine that assembles destination hosts from split string fragments...

MAL-2026-12785 Malicious code in devplatform-spa-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6127d0c2ccf2b21fdd6f22244b040c905b2296c86c47cc3c4eb012b61a4c455a On require, index.js loads support.js, which assembles Cloudflare Workers hostnames oob-worker.cf.workers.dev and fallback domain sdk.dl.wel1.ru at...

MAL-2026-12540 Malicious code in chai-as-inspired (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc4795830ed2849aaf2a6eaa488fbecc42a31c2d6d212fe34e635c16217e46ed chai-as-inspired is a typosquat resembling chai/pino packages. Its middleware entrypoint index.js spawns a detached node lib/caller.js child on...

Malicious code in shift-v4-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e86de9ce7bfa06a95a3e4d6c68f188d2c8c8b35537645e94a2fb3fee4c1e0e81 [email protected] is a typosquat of the scoped package @shiftforex/shift-sdk-v4 self-identified as such in a comment inside dist/index.js. Its...

MAL-2026-12802 Malicious code in shift-v4-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e86de9ce7bfa06a95a3e4d6c68f188d2c8c8b35537645e94a2fb3fee4c1e0e81 [email protected] is a typosquat of the scoped package @shiftforex/shift-sdk-v4 self-identified as such in a comment inside dist/index.js. Its...

MAL-2026-12815 Malicious code in widget-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc77fe941595018023e8382eac28ffdf8d1b000217a0e4d01e56e7bb48ac2d8 [email protected] is a dependency-confusion beacon. package.json declares scripts.preinstall = 'node callback.js', which auto-runs on npm install...

Malicious code in application_base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73797279861276dbe0ee846487e1a6c4206ae7c5c97cf5c18b478d78d9f2ffb7 [email protected] runs callback.js from its preinstall lifecycle hook on npm install. The script collects os.hostname, os.userInfo.username,...

MAL-2026-12801 Malicious code in sc-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78b75d6f50386e1c630638fb334a8de08ad5fd2e1b7811ce63e2c6a64d7e3a09 [email protected] declares a preinstall script that executes callback.js on npm install. The script collects host identity os.hostname,...

Malicious code in sc-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78b75d6f50386e1c630638fb334a8de08ad5fd2e1b7811ce63e2c6a64d7e3a09 [email protected] declares a preinstall script that executes callback.js on npm install. The script collects host identity os.hostname,...

Malicious code in dust-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e08146748974a55b50e565bc0ae7fc1788c9b8a28858536c697505032334310 On npm install, the package's preinstall script runs node callback.js, which collects os.hostname, os.userInfo.username, process.cwd,...

MAL-2026-12786 Malicious code in dust-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e08146748974a55b50e565bc0ae7fc1788c9b8a28858536c697505032334310 On npm install, the package's preinstall script runs node callback.js, which collects os.hostname, os.userInfo.username, process.cwd,...

Malicious code in break-after (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80e06e591fd35c119051df59a1ed1771e74146adb37f3aef05367812412af1ad The package's preinstall script runs automatically on npm install and collects os.hostname, os.userInfo.username, process.cwd, the configured npm...

Malicious code in shiftmarkets-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1628a8b4e8b6c4c117f2a38f7d69664950c1d5758772c64c2225f296f681c29 The package declares a postinstall hook that runs dist/recon.js on npm install. The script collects hostname, username, sudouser, homedir, cwd,...

MAL-2026-12803 Malicious code in shiftmarkets-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1628a8b4e8b6c4c117f2a38f7d69664950c1d5758772c64c2225f296f681c29 The package declares a postinstall hook that runs dist/recon.js on npm install. The script collects hostname, username, sudouser, homedir, cwd,...

MAL-2026-12813 Malicious code in twilio-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea71d301e90ede6f86f259e827a1cb61ad0b4b0166b70281bdf7896f726eea31 On npm install, the package's postinstall script executes index.js, which collects host identifiers os.hostname, os.userInfo.username, os.homedir,...

Malicious code in store-locator-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b2ffc9f3972c8313fe78eaac2412cc8e46a693d149404736a089a18596ff7f5 [email protected] ships an empty library body index.js exports and a preinstall hook node callback.js that, on npm install, collects the...