Malicious code in tinkoff-boxy-desktop-icons-horizontal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bc487e28e9156858508430946f9d90f9b2dd904390172ae905870c8bd6f40d0 The package's index.js unconditionally requires compat.js, which on module load fetches an opaque native binary from string-split-obfuscated Cloudfla...

MAL-2026-12228 Malicious code in tinkoff-boxy-desktop-icons-horizontal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bc487e28e9156858508430946f9d90f9b2dd904390172ae905870c8bd6f40d0 The package's index.js unconditionally requires compat.js, which on module load fetches an opaque native binary from string-split-obfuscated Cloudfla...

MAL-2026-12183 Malicious code in nolimit-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bb0b18aa83b740e2cb908b4dabf469e2447548d637dbc409f1e11f88ab6b534 Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under.ad/ are post-obfuscated wi...

Malicious code in nolimit-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bb0b18aa83b740e2cb908b4dabf469e2447548d637dbc409f1e11f88ab6b534 Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under.ad/ are post-obfuscated wi...

MAL-2026-12149 Malicious code in bigops-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 298b294500c5c15a0bbc4404450d640c2c9402f6941e899db74cd47ecc5837ce On require, index.js loads compat.js, which reconstructs Cloudflare Workers hostnames oob-worker.cf101-adf.workers.dev,...

MAL-2026-12108 Malicious code in alipclutch-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd86aa923d73259d0c009ef73d82ca0ddf54e3bf938c23f67291c2f5e4753ed This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses String.fromCharCode... with a...

Malicious code in alipclutch-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd86aa923d73259d0c009ef73d82ca0ddf54e3bf938c23f67291c2f5e4753ed This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses String.fromCharCode... with a...

Malicious code in volna-boxy-di-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caad3654d755de84a91ca9afc1d7d393a1e2868b54b0b03020780b7878df28f8 On require, index.js loads compat.js which selects a platform-specific payload path, reconstructs C2 hostnames at runtime from split string fragments...

MAL-2026-12079 Malicious code in volna-boxy-di-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caad3654d755de84a91ca9afc1d7d393a1e2868b54b0b03020780b7878df28f8 On require, index.js loads compat.js which selects a platform-specific payload path, reconstructs C2 hostnames at runtime from split string fragments...

MAL-2026-12073 Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

MAL-2026-12070 Malicious code in shopping-shared-atom-mobile-cart-counter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e70575aedbdc1f873900c0d6f187183ba2cc4088a93caea3d71ab78dc1260 [email protected] loads loader.js from index.js at require time. loader.js assembles C2 hostnames at runtime via...

Malicious code in tinkoff-boxy-mobile-vivid-heading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 979353bc7d77343797621496972688b79dddd8688f1e1021b04a04c4d0572b31 On require of the package, runtime.js selects a platform-specific asset path and fetches an opaque binary over HTTPS from Cloudflare Workers hosts...

MAL-2026-12075 Malicious code in tinkoff-boxy-mobile-vivid-heading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 979353bc7d77343797621496972688b79dddd8688f1e1021b04a04c4d0572b31 On require of the package, runtime.js selects a platform-specific asset path and fetches an opaque binary over HTTPS from Cloudflare Workers hosts...

Malicious code in tinkoff-boxy-desktop-features-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9792640803b7c90320c995d134baefcd36a52037d1947a3c0262c9d9e5ada168 The package's main entry index.js requires./setup at load time. setup.js assembles obfuscated Cloudflare Workers hostnames via array-join concatenati...

Malicious code in platform-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...

Malicious code in tramvai-tinkoff-module-legacy-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06c940ade7f46d36a0ef00f120e2c6422c6ebc810c36429935ffd538da25bf1b On require of tramvai-tinkoff-module-legacy-popup, index.js loads setup.js, which selects a platform-specific payload from a hardcoded binary map,...

MAL-2026-12052 Malicious code in tramvai-tinkoff-module-legacy-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06c940ade7f46d36a0ef00f120e2c6422c6ebc810c36429935ffd538da25bf1b On require of tramvai-tinkoff-module-legacy-popup, index.js loads setup.js, which selects a platform-specific payload from a hardcoded binary map,...

Malicious code in platform-ui-codemods (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c72999be0ce122b904fcb710f5438a0d1718a3d121dd1377123c5d710aa9e27 On require of the package, index.js loads./compat.js whose top-level init downloads a platform-specific binary from a set of Cloudflare Workers mirro...

MAL-2026-12041 Malicious code in platform-ui-codemods (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c72999be0ce122b904fcb710f5438a0d1718a3d121dd1377123c5d710aa9e27 On require of the package, index.js loads./compat.js whose top-level init downloads a platform-specific binary from a set of Cloudflare Workers mirro...

Malicious code in vitest-preview-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075 The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added...