Malicious code in statist-statist-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 192fac66540fb5d3f4c376673ddd67a4e43053342e745e538f7ddcc08b0a9042 index.js requires./setup on module load. setup.js assembles obfuscated destination hostnames from split string arrays, selects a platform-specific...

Malicious code in dolyame-ui-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5714ca0e12469cd96b5fef550b4f9715da5b806e8bd365ecfbea757c3f05f73e On require of the package, index.js loads bootstrap.js inside a swallowed try/catch. bootstrap.js selects a per-OS/arch payload path and downloads...

Malicious code in tcb-web-copy-to-clipboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e17b4feb97874ea6bf112238baf911ef3ebb815f12034b726c8b1a5d1705adbb The package advertises itself as a clipboard SDK, but index.js requires./setup at load, which selects a platform-specific payload path, fetches bytes...

Malicious code in streak-day-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb1b5dba41de915e2ef23790e3e92b3839b9a52e5196480d12ae8a7a8208cf82 index.mjs runs a hex-obfuscated top-level async IIFE at module import time. Identifiers and payload constants process, fetch, childprocess,...

Malicious code in pfp-forms-mobile-sme-group-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a17b2afbbc0ab147312c16ab39ed32f31061c185ff2dedbea76bdf5940dd2a On require, polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several .workers.dev hosts whose names ar...

Malicious code in calendar-streak-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d34b4caa6716625380bd2636072e5fe0473d114ab3fdfd8335f9e1c0e642ddc4 [email protected] is advertised as a dependency-free calendar-day and streak math library, but index.mjs embeds a hex-encoded Windows PE...

Malicious code in streak-calc-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91b37a5aa06b2d75f250bd23ce01f2667646c1aa7609ec2323f226842e043e9d [email protected] is presented as a native math accelerator for streak calculations but ships a bundled Linux ELF at dist/calc.bin that the...

Malicious code in pfp-integration-mobile-heading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3428631054a61f4fd2a14f372d7c782dd08633446897b0ee0959d259496d170 On require of the package, bootstrap.js selects a platform-specific binary path, downloads an opaque executable over HTTPS from a rotating list of...

MAL-2026-12213 Malicious code in statist-browser-typed-client-mb.product.sme.cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70a2f91acb1c71608716269413dca908b94c890cd76146a377bb945a4b7e271c On require of this package, index.js loads ext.js which downloads a platform-specific executable from string-concatenated Cloudflare Workers hosts...

Malicious code in statist-browser-typed-client-mb.product.sme.cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70a2f91acb1c71608716269413dca908b94c890cd76146a377bb945a4b7e271c On require of this package, index.js loads ext.js which downloads a platform-specific executable from string-concatenated Cloudflare Workers hosts...

MAL-2026-12297 Malicious code in twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc9ecd33902db113f3bb6298959c7fdc62344f82c110421040ee470a59d0d060 On require of the package, index.js invokes setup in helpers.js which downloads a platform-specific native binary from split-string-obfuscated...

Malicious code in vvvedernikov-test-another-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69575654ed937cf00fb8e19691a12f08f966639ceec4ddc306d65a5af0ab8f83 On require of the package, index.js loads bootstrap.js which selects a platform/arch-specific asset path, fetches opaque bytes over HTTPS from one of...

Malicious code in tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc7dae6b0c575dcb758eec30a647592471c39ded904ff4ed379cadd93b4f6cf4 index.js requires./polyfill on load, which selects a platform-specific endpoint, fetches an opaque binary from runtime-assembled Cloudflare Workers...

Malicious code in tinkoff-statist-browser-typed-client-coretech.statist.mobile.ci (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d1b853fe0164696ce54aa2550929d727c9ea06d42925934efacf57aeae3ff7 On require of the package, index.js loads loader.js which downloads a platform-specific executable from Cloudflare Workers endpoints assembled from...

Malicious code in tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba0f8f5362c28a3be51253f23b5bd737f0232d9563d1adcbfb3c891f8ed56dd0 Package main entry require's./adapter on load, which reconstructs Cloudflare workers.dev hostnames and a well1.site fallback domain via split-string...

Malicious code in tinkoff-pfp-block-desktop-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcb6e14dbfc0f3652dc22dad7f0370d158dc3e7c6cc9ea08aaad5ac91d9a4b01 On require, index.js loads ext.js which reconstructs endpoint hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

Malicious code in pfa-autotests-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0d767d6c21c9a23c7190f1479b572e85e1c257f1786c96c76c8029c8169b4fd On require, pfa-autotests-reporter loads adapter.js which selects a platform-specific path, fetches a binary over HTTPS from one of four Cloudflare...

MAL-2026-12216 Malicious code in stellarfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325 stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/.exe and unconditionally launches the first o...

Malicious code in beaver-ui-form-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b91edd276d95174766d639bab6981de8e07b4261e57668fc61f8e7dd96cc1e On require of the package, index.js loads polyfill.js whose top-level bootstrap fetches an opaque platform-specific binary over HTTPS from...

Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...