Malicious code in dolyame-ui-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7679dd0e86411f0df5eea8392ad6f6a663ab0d911cd674b3ef4605af846cb323 On require of dolyame-ui-breadcrumbs, index.js loads bridge.js which reconstructs C2 hostnames at runtime via string-splitting/array-join resolving t...

Malicious code in dolyame-boxy-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e5ba9319e9ab791d3944f19baaae57aac3c2d381bf03ccf736d8ae09a2ba4b6 On any require of the package, index.js loads./compat.js, which fetches a native binary from string-fragmented Cloudflare Workers hosts under...

Malicious code in dolyame-ui-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b0f03a063fb3a6b8c7605612b587eddfefa6181b85b14654ee93f267dd790e1 On require of the package, index.js loads compat.js, which at module load time downloads a platform-specific binary from hostnames assembled at runti...

MAL-2026-13173 Malicious code in dolyame-ui-pie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f473b4f8898130c8b57fd3a129bf81a38b449ea8970e58a6e4c486943eb5579 Requiring the package triggers async initialization in support.js that downloads a platform-specific binary linux x64/arm64, darwin, win32 from...

MAL-2026-13196 Malicious code in dolyame-ui-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9a2d0e912bed4c7005a9945215406319204611c186b19d77065d1a5216e5fb1 Requiring the package loads ext.js, which downloads a platform-specific binary from obfuscated .workers.dev endpoints with a DNS-TXT base64 fallback...

Malicious code in bigops-tcrm-identity-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 183fa24523e19286718ff854ed8d080c8d8635d6d914a3fbb871c388660fc479 [email protected] is a dropper disguised as a session-management utility. Its main entry index.js requires bootstrap.js on load, which...

Malicious code in bnpl-blocks-atom-bnpl-store-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953b66d4203e461d482f00a2011c4d79b4fd30ab0749ca3e9946837d20e48504 The package's main index.js requires ./loader at module load, causing loader.js to download a platform-specific native executable from hardcoded...

Malicious code in bnpl-blocks-desktop-bnpl-floating-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 475a5832e13fe3f55a82c47aace786100dd62ae9c5c5d31e7408ac59930cc917 On require of the package, index.js loads helpers.js which downloads a platform-specific binary from Cloudflare Workers hosts whose domain strings ar...

Malicious code in beaver-ui-split-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9758e9a6587fb3c1314e69b881d33a634fb0255cf6bdd3540ab74a533aacc1 On require'beaver-ui-split-view', index.js loads bootstrap.js, which selects an OS/arch-specific asset and fetches an opaque binary over HTTPS from...

Malicious code in bnpl-blocks-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a02f6576518bfc325248a8787aff66ebad12acc3e63b05fd7b35f96ffd1a62d6 The package's index.js requires runtime.js on load, which fetches a platform-specific native binary from one of three Cloudflare Workers hosts...

MAL-2026-13049 Malicious code in boxy-get-retry-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bd36db17d5636ee0cd74be0ca5d35fc190e75749360c297ecd52821d74ab8b8 On require, index.js delegates to helpers.js which selects a platform-specific asset path, downloads an opaque binary over HTTPS from obfuscated...

Malicious code in bpm-foundation-bundle-optimization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfdca3178e2278bbc76607ff9bf6ee6a3b0d2d60db7281a231288f442a1fb616 Requiring this package triggers vendor.js, which reconstructs Cloudflare Workers hostnames oob-worker.cf10.workers.dev and DNS-fallback domains...

MAL-2026-13111 Malicious code in bpm-foundation-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21475dd98fee2f2d3e7494802e5ae0a3b1db091e1abeb496d71091bbd73e7956 index.js unconditionally requires runtime.js on module load. runtime.js selects a platform-specific endpoint /pkg/package, /pkg/package-arm64,...

MAL-2026-12515 Malicious code in bpm-foundation-test-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de196f443359e53af966cb2ca288d90e59e708c2cf7ad33ab2e0e20b7df2869e On require, index.js loads setup.js which assembles destination hostnames at runtime from split string fragments resolving to...

Malicious code in cards-forms-cards-core-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d987094f38a49c0bb9ae5329e3ff47d97489ee5af348ebc7e056e752cffc1fb On require, index.js loads runtime.js which detects OS and CPU architecture, reconstructs C2 hostnames from split string fragments...

Malicious code in checkout-desktop-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5571b1ecfcbc9597cee92fc50abf9c5b373ba20b62038ab0623adc05eb726b The package's main entry unconditionally requires./loader on load. loader.js reconstructs C2 hostnames from string fragments oob-worker.cf.workers.de...

MAL-2026-12552 Malicious code in checkout-create-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf66f90f0fd4a6d5d6478f1b032efc6d9eaf3c2e7d02fe60b566b02ea4a68193 Package advertises itself as a token-generation library but its main entry index.js silently side-loads platform.js via a try/catch require. On impor...

MAL-2026-12555 Malicious code in checkout-desktop-cashback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04ab0105316a6f7d59b244610cd7a5c702e2157987ca7b91674cd34d032acf70 On require'checkout-desktop-cashback', index.js loads vendor.js which fetches a platform-specific binary from obfuscated Cloudflare Workers endpoints...

MAL-2026-12575 Malicious code in checkout-mobile-input-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8121f8e2d367655a7ee2c6b8630e4e6210cee3b5ecded80de7e07f7dc61446e On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames...

Malicious code in checkout-mobile-pay-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57c8ea8352e1550f445ade3ea180ed272af5e77663f68d6d65ca9c90891d451f [email protected] is a dropper disguised as a mobile-payment/native-bridge SDK. On require of the package, index.js unconditionally...