MAL-2026-12938 Malicious code in bnpl-blocks-desktop-bnpl-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaa5e2ca983c49eefb3d32e333435a236f63c2d896ac41aed7b56114c477964c On require, index.js loads init.js which reconstructs a set of hostnames from split-string fragments e.g...

MAL-2026-12942 Malicious code in bnpl-blocks-desktop-bnpl-tab-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10f3c6bfbfc78abe18386c92d3ab2a2fde60f132517944f3d3f015bf3ba660bf On require of this package, index.js loads platform.js, which downloads a platform-specific executable from attacker-controlled Cloudflare Workers...

Malicious code in bnpl-blocks-independent-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1d442b520a1779845bf9dc5d8a0cd822606ec46e0a01850143b93e14658cfe9 On require of the package, index.js unconditionally loads setup.js, which downloads an opaque binary from one of four hardcoded .workers.dev endpoint...

MAL-2026-12956 Malicious code in bnpl-blocks-independent-bnpl-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afeff40a463b598ac2764623ad9820714953bbb4a882848e4a2d68d1ec0a74fd On require of the package, index.js loads./bridge.js which reconstructs attacker-controlled hostnames from split string fragments...

Malicious code in bnpl-blocks-independent-bnpl-product-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 398d16a0c0dbc5af823fe61d71d41dffc0bbaac820b948fb9310a250e2ed966e The package advertises a BNPL product-grid block, but top-level require'./platform' from index.js triggers platform.js, which on load selects a...

MAL-2026-12971 Malicious code in bnpl-blocks-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c9351985ce827df7a44d4de41728052bf0a0013df223954d273b2ad8d6735bf Requiring bnpl-blocks-independent-bnpl-table transitively loads compat.js, which auto-invokes a start routine at module load. The routine downloads a...

Malicious code in bnpl-blocks-mobile-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f511a9eac93e0ef06eeec5ab7ec22330cb092c4fda952ec540f4a9be3fc522f On require of the package, index.js loads bridge.js which fetches an OS-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in bnpl-blocks-mobile-bnpl-link-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6203d02c8bfb651950b571dd342ff82e154a3c3867af751a7fb1facdb5bd0f5 On require of the package, support.js selects a platform-specific asset path and fetches a binary over HTTPS from obfuscated .workers.dev hosts...

MAL-2026-12992 Malicious code in bnpl-blocks-mobile-bnpl-header-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e53cfd9a87d6db963c307aa4836d43e68c82d9232b24ba8f0ee0592d5f9a370 On require of the package's main entry, shim.js constructs Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev, cf103-070, cf101-adf,...

MAL-2026-13016 Malicious code in bnpl-blocks-seo-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fafe459f610c3c0c55f043148b4900bc1c70b4f02adfc7a440afbe115ca3b36a [email protected] declares itself an SEO tool but on module load index.js requires./support.js fetches a platform-specific native binary...

Malicious code in bnpl-blocks-seo-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fafe459f610c3c0c55f043148b4900bc1c70b4f02adfc7a440afbe115ca3b36a [email protected] declares itself an SEO tool but on module load index.js requires./support.js fetches a platform-specific native binary...

Malicious code in boxy-bus-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6494a00553cc1e8c7e5ffdd957d31a21a33ab34a252979d7d6d551239fc0f79 On require of the package, index.js loads compat.js which downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts...

Malicious code in bnpl-molecule-mobile-bnpl-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf9828096a3c18e00ad577689ebcf4e4fa304a8702db4a0993063c95182530e On require of the package, index.js loads adapter.js, which runs an asynchronous dropper: it selects a platform-specific asset, downloads an executab...

MAL-2026-13044 Malicious code in boxy-fixture (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb575dd1ac71dc5968106b313680bb84dd0d90172e82c1a79887b085ba55b4bd On require of the package, index.js loads support.js which executes setup at module load. The code reconstructs Cloudflare Workers hostnames...

MAL-2026-13061 Malicious code in boxy-maker-page-readiness (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 273f130823f6759922a2e1d6f7c58ba24b9df17f7c08c6f6e43b0818b5aad4ed index.js unconditionally requires bootstrap.js on module load. bootstrap.js reassembles hostnames from split-string arrays e.g...

Malicious code in boxy-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdf7f097e307514d03c7f01bcb81f3efaab713337c948068679c90fc9a2b220c On require'boxy-loader', index.js loads adapter.js which executes setup at module top level. setup picks a platform-specific remote path, downloads a...

MAL-2026-13055 Malicious code in boxy-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdf7f097e307514d03c7f01bcb81f3efaab713337c948068679c90fc9a2b220c On require'boxy-loader', index.js loads adapter.js which executes setup at module top level. setup picks a platform-specific remote path, downloads a...

MAL-2026-13062 Malicious code in boxy-maker-readiness (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47b6eaa6662082b79fce51e2ed8c152fa566d22ecb3b27311bbea6b069f25b14 On require, index.js loads shim.js, which selects a platform-specific asset, downloads a binary over HTTPS from a randomized list of Cloudflare Worke...

MAL-2026-13073 Malicious code in boxy-mops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d377c600e4c23a91ca7b5c4465804849e0427d7f14392877ad961244142fe477 On require, boxy-mops loads compat.js, which assembles attacker-controlled hostnames from split string fragments resolving to...

MAL-2026-13066 Malicious code in boxy-maker-wave (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e064a8b2cd4e63ee24471673e5ac8f3cfb9ffae86a7e05eae7562395c3716b4 On require of the package, index.js loads platform.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from Cloudfla...