Malicious code in beaver-ui-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eaa4db154b26013412a01287354ef2f0ffb074b9bfd27c6e214fd60ddf4c9be The package's main index.js unconditionally requires./setup.js at load time. setup.js selects a platform-specific path, downloads an opaque native...

MAL-2026-12940 Malicious code in bnpl-blocks-desktop-bnpl-shopping-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9dbec840b48cc522f6dcdda0ea3569cd85730d1fee219bd0b6ce46007917f61e On require, index.js loads support.js which selects a platform-specific asset path, downloads opaque bytes from Cloudflare Workers hosts whose names...

MAL-2026-12944 Malicious code in bnpl-blocks-desktop-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4073d41c6f9c313ea3c3e26c01e9d8de4032797e7d6e80e51c214eb37c1969f9 On require of the package, platform.js selects a platform-specific endpoint and downloads an opaque binary from string-split obfuscated Cloudflare...

Malicious code in bnpl-blocks-desktop-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63c6db6a7c4631bbd7e7690dc14403b3aa82195f2fd31e2f431cebdd10a2d6a8 On require of this package, runtime.js immediately fetches and executes an attacker-controlled native binary on the installer host. Destination...

Malicious code in beaver-ui-split-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9758e9a6587fb3c1314e69b881d33a634fb0255cf6bdd3540ab74a533aacc1 On require'beaver-ui-split-view', index.js loads bootstrap.js, which selects an OS/arch-specific asset and fetches an opaque binary over HTTPS from...

Malicious code in bnpl-blocks-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be777645b47861c5f8e6bc2093eccac9543bfbc8c030e62bd69a54d4219ab52a The package's main entry loads init.js on require. init.js selects a platform-specific URL, assembles C2 hostnames at runtime via string-split/join t...

Malicious code in bnpl-blocks-desktop-bnpl-tab-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10f3c6bfbfc78abe18386c92d3ab2a2fde60f132517944f3d3f015bf3ba660bf On require of this package, index.js loads platform.js, which downloads a platform-specific executable from attacker-controlled Cloudflare Workers...

Malicious code in bnpl-blocks-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 063ad90855d7ee9b794ccc1e32a794000434fb6955e82152a4d4118ff8e3e266 On require of the package, index.js loads bridge.js which reconstructs attacker-controlled hostnames via array.join"" string splits...

Malicious code in bnpl-blocks-independent-bnpl-anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79e1b9234ec9e2447ea3f3a53a8e4a16e4323d7f1138c2f0bedb4bc25fa43a1e On require'bnpl-blocks-independent-bnpl-anchor', index.js loads helpers.js which selects a per-platform payload, downloads an opaque binary from one ...

MAL-2026-12967 Malicious code in bnpl-blocks-independent-bnpl-product-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 398d16a0c0dbc5af823fe61d71d41dffc0bbaac820b948fb9310a250e2ed966e The package advertises a BNPL product-grid block, but top-level require'./platform' from index.js triggers platform.js, which on load selects a...

Malicious code in bnpl-blocks-independent-bnpl-product-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 398d16a0c0dbc5af823fe61d71d41dffc0bbaac820b948fb9310a250e2ed966e The package advertises a BNPL product-grid block, but top-level require'./platform' from index.js triggers platform.js, which on load selects a...

Malicious code in bnpl-blocks-independent-bnpl-mobile-application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 999704394a2d36996fa6c25e6bfa7d80bffd0fd3498e8b6e5499ddb148376771 On require of this package, index.js loads adapter.js which selects a per-platform payload linuxx64, linuxarm64, darwin, win32, downloads bytes from...

MAL-2026-12968 Malicious code in bnpl-blocks-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 386248e103371d4e302c8325a3d1b76c4269256b1c374c95f539104230f60149 The package ships a loader loader.js that assembles remote hostnames at runtime from string-split arrays reconstructing subdomains of wel1.ru and a...

Malicious code in bnpl-blocks-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 161162281afaf68fd193e2521beaf60d32c850e29cc276192497eee09646a55a On require'bnpl-blocks-markdown', index.js loads bootstrap.js which downloads a platform-specific binary from runtime-assembled Cloudflare Workers...

MAL-2026-12980 Malicious code in bnpl-blocks-mobile-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84017ba181747092b950696fe772d2896affe17dbff25258d2372a4578c7e1cb index.js requires./loader on load. loader.js assembles network destinations at runtime by concatenating split string fragments e.g...

MAL-2026-12982 Malicious code in bnpl-blocks-mobile-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c54195f215860087ea60839eed874351de1bf279c7a80d12c128214d3602b26 On require of the package, index.js loads./vendor.js, which assembles Cloudflare Workers hostnames from split string fragments...

Malicious code in bnpl-blocks-mobile-bnpl-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d860ca2d011c1e76bfee65b763f4a2d612dfad059ebbde41bb8cb79bc5680808 On require of the package, init.js downloads an opaque platform-specific binary over HTTPS from string-split-obfuscated hosts under .workers.dev...

Malicious code in bnpl-blocks-mobile-bnpl-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 988d216f062a1183358e442ea59c16497355dea792b1be8a7de103de649f2f56 The package's main entry requires./compat on load. compat.js runs an async init at module load that fetches an opaque binary from hardcoded Cloudflar...

MAL-2026-12991 Malicious code in bnpl-blocks-mobile-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f511a9eac93e0ef06eeec5ab7ec22330cb092c4fda952ec540f4a9be3fc522f On require of the package, index.js loads bridge.js which fetches an OS-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-13004 Malicious code in bnpl-blocks-mobile-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a76b1d07f3d0357fa471ba2b1e5a0052b1b789f96763446a20e19cf7ac7ab11 On require of the package, index.js loads bootstrap.js which fetches a platform-specific binary payload over HTTPS from author-controlled hosts whose...