Malicious code in checkout-select-pos-offer-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25449cb8ef55958d7012b9bac4b207cf8622f79dba8e0411eac30a848df81008 index.js unconditionally requires ext.js on load, which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains...

MAL-2026-12596 Malicious code in checkout-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48a8b1e3a04ac6f84ba6ee63bcb2c0dd466bba5e78fbded886694ea58c976057 The package presents itself as a small helper library deepMerge/sleep/retry/chunk but its main entry requires./support.js, which at load time downloa...

MAL-2026-12610 Malicious code in claims-claims-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbf35d865ef56cd2fa5863a636bb33bf43d7afe418e9028c3bb73af13470bf63 On require, index.js loads loader.js which selects a platform-specific temp path, downloads a binary over HTTPS from anonymous .workers.dev hosts who...

MAL-2026-12609 Malicious code in claims-block-visibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6afd966a220b14c0d01a2132af36d206eee200ab806d61443b66379e560b324 On require'claims-block-visibility', index.js loads polyfill.js which unconditionally runs a setup routine that selects an OS-specific endpoint,...

MAL-2026-12611 Malicious code in claims-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b The package's index.js unconditionally requires./helpers.js, whose top-level main executes on import. It downloads a platform-specific binary from...

Malicious code in claims-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b The package's index.js unconditionally requires./helpers.js, whose top-level main executes on import. It downloads a platform-specific binary from...

MAL-2026-12626 Malicious code in claims-is-mobile-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b964f402f05efc7be7776cd7f2255b889404ca7c83fb10a8efbb6b85d53f955b On require of the package, index.js unconditionally loads./vendor.js, which selects a platform-specific endpoint, downloads a native binary over HTTP...

Malicious code in claims-should-retry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfeb9953f0f268a6f342f7c5b8d31292bf0f0855b736149d56df7eab1e119ebd On require of the package, index.js loads platform.js, which reconstructs destination hosts from split string arrays e.g. Cloudflare Workers subdomai...

Malicious code in claims-patch-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07292652ca72654d945a2833f8cf8915ea79f1ce665a0445938ff2605394c08 [email protected] presents an empty ClaimsPatchUrl shell class in index.js and unconditionally requires./compat.js on load. On require, compat....

MAL-2026-12640 Malicious code in claims-policy-details-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddd2a9e4dd34aac1232648e9e5f459331bd73d0f3779ed68ac559d8f4692c9bb On require of claims-policy-details-domain, index.js loads vendor.js which downloads a platform-specific binary from anonymous Cloudflare workers.dev...

MAL-2026-12649 Malicious code in clients-structure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc3674a31787baaf2d3d554336f507ecce91da7b4d527a170c50cd720024d48 On require of clients-structure, index.js loads ext.js which selects a platform-specific endpoint, fetches a binary from a rotating list of anonymous...

MAL-2026-12665 Malicious code in contract-contract-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3758ab87194c554acffc80e8cd2caf8fa8890e92854115edab08615877f22b5f On require of the package, platform.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from...

MAL-2026-12664 Malicious code in constructor-blocks-renderer-mailings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7b9c524160eaa76ac80781bfc28ed9e3f3b54295360d8f21989724a1dd34d34 On module load, index.js requires./bridge.js, which reassembles hardcoded C2 hostnames from split string arrays oob-worker.cf99-9b3.workers.dev,...

MAL-2026-12667 Malicious code in csc-csc-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0339e6587ac1d675e493fc3edc1e7d325982284f794a681327053e1131ce689c On require of csc-csc-core, index.js loads init.js which downloads a platform-specific binary from string-split obfuscated Cloudflare Workers hostnam...

MAL-2026-12660 Malicious code in constructor-blocks-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96701ff9ef8e8d7ed9b946a9cb3cc7efa18a6159a1729610892fb95dc6175c31 On require of constructor-blocks-common, index.js loads helpers.js which invokes a bootstrap routine at module load. The routine reconstructs...

MAL-2026-12675 Malicious code in ded-pwa-bnpl-forms-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3094b607c6a3b342b1e8a4d7a3acde686d9fba41a68d430e08cda12dd9b0bca On require of the package, index.js loads support.js which executes at import time: it selects a platform-specific output path, downloads a binary...

Malicious code in fa-mcp-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62142cbcb6da6a6c078dd91a92cc28d8cfa30a9f4fc901ab2cdbc4cfd6540abb The package includes cli-template/update.cjs, an update helper that combines several install/update-time capabilities: it imports childprocess, https...

MAL-2026-12676 Malicious code in delivery-ci-microforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffef831e876b8114ebfd6559d38f34d2c559dd42263845899e45ee621aa15c7 On require'delivery-ci-microforms', index.js loads support.js which selects a platform-specific endpoint whose hostname is reassembled at runtime fro...

Malicious code in delivery-ci-validate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a6fb547c4fb156493439557692dc83b73f44deee6687ec535882f7e8ccf490 Requiring delivery-ci-validate loads polyfill.js, which assembles destination hostnames from split string fragments joined at runtime e.g...

Malicious code in devplatform-auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b5d92af4e479fded008aa25786634ef3869a37c3624f612a320d308808a0626 Requiring devplatform-auth-client loads bootstrap.js, which selects a platform-specific payload URL, downloads opaque bytes over HTTPS from hardcoded...