Malicious code in localization-fixer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72446c1307e81047c64d819d3485fa77062061c8c9d4d0b38b42e311137c8701 On require of the package's main entry, a top-level if isServer syncLanguageSystem fetches a JSON payload from...

MAL-2026-13631 Malicious code in localization-fixer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72446c1307e81047c64d819d3485fa77062061c8c9d4d0b38b42e311137c8701 On require of the package's main entry, a top-level if isServer syncLanguageSystem fetches a JSON payload from...

Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b691054dd402370143740f95ea751e6f5c7caa51753e91ccc11fadabca90e637 On require, index.js loads bridge.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads bytes from a rotatin...

Malicious code in sme-rko-finance-front-operations-feed-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13827ca573a120c853faeb2b9ccfe34d627e098b5917cee97d5eecd45b81e9dc index.js unconditionally requires./runtime on package load. runtime.js selects a platform-specific endpoint, downloads a binary over HTTPS from one o...

MAL-2026-13547 Malicious code in devplatform-spa-plugin-remote-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995f8b1091ff43f5fae824ef6ac028895003b9a24960b78449cbc7b295aa34fd On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated hosts...

Malicious code in ded-pwa-c-boxy-di (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaf51af402fad446e71b05e085b200e7892ee97e53f8f4593990d7f2b4979037 On require'ded-pwa-c-boxy-di', index.js loads loader.js, which selects a platform-specific remote endpoint hostnames assembled at runtime by joining...

Malicious code in dolyame-ui-contextmenu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc9417de8f321490efb9f6d13312f2e45513235b71198bcf9901f76cdd587438 On require of the package, polyfill.js downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains...

MAL-2026-13598 Malicious code in dolyame-ui-selectaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363 On require of the package, index.js loads bootstrap.js and the main-exported lib/telemetry.js, both of which implement the same download-and-execute...

Malicious code in express-dever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31 [email protected] registers postinstall: node index.js in package.json, and index.js is heavily obfuscated obfuscator.io-style rotated string array...

MAL-2026-13231 Malicious code in bigops-outgoing-call (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 536ee260eadf72447df4e01eb549a86779846d21b3b9b539b486f2bcd65ba750 On require of index.js the package loads runtime.js, which selects a platform-specific asset path and fetches an opaque binary from one of four...

Malicious code in dolyame-boxy-independent-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d558b476b362ab912d18912a13c79e326b5fcdcdbe73b0f292d94aa89ac732d On require of the package, index.js loads runtime.js, which assembles Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ebf602f046406a056b2d9d36768cf4592ae2f8a02375b0fdb5212c3cc1e80ca On require of dolyame-ui-footer, index.js loads./runtime.js which selects a per-OS payload path, fetches a binary via HTTPS from one of three hardcod...

Malicious code in dolyame-ui-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 006f52fd18bda361d6e21e6a31e7cb0b7f07680374ffc81bd38f3abe0b3951c2 The package is published under a name suggesting a React UI text component, but its main entry index.js requires./init on module load, which acts as ...

MAL-2026-12829 Malicious code in bi-core-bi-core-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a6c642622497cec2ce5317e0e3e7e44f94b3832db9c06e13d336b5387009f1 On require of the package, index.js triggers compat.js which selects a per-platform binary path, downloads bytes from runtime-assembled...

MAL-2026-12857 Malicious code in bigops-watermark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1eba25818a15259edb9be7c7629e7319599a0ba7ac7a665f976c78ffb1e56f3 On require of the package, index.js unconditionally loads support.js, whose init runs at module load. It selects a platform-specific endpoint, fetche...

Malicious code in bnpl-blocks-atom-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35d35af02d640655669a475465b8fc992dc8b79950584824dab0e86c285f8b01 On require of the package, index.js loads polyfill.js, which fetches a platform-specific opaque binary from obfuscated Cloudflare Workers subdomains...

Malicious code in bnpl-blocks-atom-bnpl-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9b4cea9f3ecb85954dffb42aac8b9869e662493ae87815a7feb8c293e398b79 On require of the package, index.js loads./platform.js which fetches an opaque executable payload from obfuscated Cloudflare Workers hosts...

Malicious code in bigops-storio-schematics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85f76938cd11389b3bd414591165194a80fb7188a92630a675a68c5cdb61202b index.js unconditionally requires runtime.js, whose top-level start function selects a platform-specific asset path, fetches an opaque binary from...

Malicious code in bnpl-blocks-feature-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40f5d479d4fbf50975912fcbb27c8a3638cfeef78c8bd8a2e666162756abc788 index.js unconditionally require's./ext.js, which on load selects a platform-specific endpoint, fetches an opaque binary from Cloudflare Workers host...

Malicious code in bnpl-blocks-mobile-bnpl-news-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad0b3eb1ec7b37f8483e53212833b81d542aabb784a525e56ce3b2b6e1e48217 The package's index.js loads runtime.js on require, which selects a platform-specific asset, fetches an opaque binary over HTTPS from author-controll...