MAL-2026-13073 Malicious code in boxy-mops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d377c600e4c23a91ca7b5c4465804849e0427d7f14392877ad961244142fe477 On require, boxy-mops loads compat.js, which assembles attacker-controlled hostnames from split string fragments resolving to...

MAL-2026-13066 Malicious code in boxy-maker-wave (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e064a8b2cd4e63ee24471673e5ac8f3cfb9ffae86a7e05eae7562395c3716b4 On require of the package, index.js loads platform.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from Cloudfla...

MAL-2026-13071 Malicious code in boxy-mmb-deps-pvm-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 088639f9b19ce8234cef116c0250628c6894bd509915aa90639c56436ec19646 index.js unconditionally loads polyfill.js on require. polyfill.js reconstructs attacker-controlled hostnames from split string literals...

Malicious code in boxy-pkg-deps-hash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1da74d1d4290df1bf3113989f436e444b8596103ce2a703bb0d6bcbbcff44e0a On require of the package, index.js loads adapter.js and unconditionally invokes setup. setup downloads a platform-specific binary from hardcoded...

Malicious code in boxy-temper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3410beb63f55222c2e4d1823fae16f5de4cc07ec2ba428712d482737c72bbd2 index.js requires bridge.js on module load. bridge.js selects a platform-specific URL from a list of Cloudflare Workers hostnames whose strings are...

MAL-2026-13105 Malicious code in bpm-foundation-base-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d880fad0158970d8ef9b0a0884fe6b2ceee572d3046db4cf08745d02d3c34293 On require, index.js loads helpers.js, which reconstructs C2 hostnames via string-split-join concatenation...

Malicious code in boxy-wrapper-rspack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c The package advertises itself as an rspack plugin but ships a stub index.js that silently requires adapter.js, which runs at module load time...

Malicious code in bpm-foundation-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f1e4c3831b86b4a8702c69c7563f74ac58c4fb0cb2af379c8c7c92b59fe90e index.js unconditionally requires./init.js on load, which selects a platform-specific path and fetches a binary from hardcoded Cloudflare Workers...

MAL-2026-13109 Malicious code in bpm-foundation-delegate-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ff3bed0d9c04b7357e684ac9feee57efd9dcfc6c5834dc352089b425e7577dc On require/import of the package, index.js loads setup.js at module top level, which assembles attacker-controlled hostnames from split string...

Malicious code in bpm-foundation-date-range (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fac5d5e2ebbf743977ac3ac1149da83ee41c1b7b98b10e97619e83fd3a18550c Requiring the package's main entry triggers polyfill.js, which selects a platform-specific endpoint and downloads a native binary over HTTPS from...

MAL-2026-13119 Malicious code in bpm-foundation-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1e2729c7a957ee4366b693a24d178137743df7bf2ee5d65d3cecf3c8cfdc5f On require, index.js loads ext.js, which selects a platform-specific path, fetches an executable over HTTPS from string-concatenation-obfuscated host...

Malicious code in bpm-foundation-rate-us (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14633165714201c44b540cc6b04a1f9bd6c311e27ec921e3c0011d6696120d54 On any require/import of bpm-foundation-rate-us, index.js loads compat.js, which assembles hostnames from split string fragments to hide the...

Malicious code in bpm-foundation-test-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de196f443359e53af966cb2ca288d90e59e708c2cf7ad33ab2e0e20b7df2869e On require, index.js loads setup.js which assembles destination hostnames at runtime from split string fragments resolving to...

MAL-2026-12528 Malicious code in cards-forms-debit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cfb99b5f4ad953f445a050a5cb70c26e477398cedef5406fdce1343887a6e38 On require, index.js loads shim.js which downloads a platform-specific binary from anonymous .workers.dev subdomains hostnames assembled at runtime b...

Malicious code in cards-forms-clone-credit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b4f08d76d45a73180470637c59e6f64755dcc8f24853b66140d014b1dcbbdf8 On require of cards-forms-clone-credit-clone, index.js loads helpers.js which auto-invokes a setup routine that detects the host OS/arch, downloads a...

Malicious code in cardsmobile-data-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5f06952752248dcbd4411398f97014f1fd133db0cb66bfeb2b7121a4f974feb On require of cardsmobile-data-utils, index.js loads./vendor.js, which downloads a platform-specific native executable over HTTPS from hardcoded...

MAL-2026-12536 Malicious code in cardsmobile-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d80bf756b4d7e7f6e27afd68a796dc43ca50d28e692d11b4af141b0af5235b On require, index.js loads shim.js which selects a platform-specific payload URL from a string-split-obfuscated list of Cloudflare Workers subdomains...

Malicious code in cardsmobile-command-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36cfe57bdba8edd36f9303058545ce1097dd496f1c32304f1d8d912ccf321480 On require, index.js loads bridge.js which selects a platform-specific URL, downloads a binary over HTTPS from author-controlled Cloudflare Workers...

Malicious code in checkout-accounts-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b3edb78076f5105de32feda80276d41059215378d6ab90f2d11a332685c6a On require, the package loads adapter.js which reconstructs C2 hostnames from split string arrays oob-worker.cf99-9b3.workers.dev,...

Malicious code in checkout-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29b244ec0b7c63b76c59ceef313391742ea858b300088653f5da701db9ca7611 On require, helpers.js reassembles hostnames via array split-and-join to hide the destinations oob-worker.cf.workers.dev and .dl.wel1.ru subdomains...