MAL-2026-14275 Malicious code in minequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54dfa76784b35d5d63fa89a85c071e83d21e55291871b40627c36015291f24a1 package.json declares a postinstall hook running scripts/init.js, which chmod 0755's assets/thanks-amd64.elf and execFileSync's it on Linux x64 durin...

Malicious code in minequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54dfa76784b35d5d63fa89a85c071e83d21e55291871b40627c36015291f24a1 package.json declares a postinstall hook running scripts/init.js, which chmod 0755's assets/thanks-amd64.elf and execFileSync's it on Linux x64 durin...

MAL-2026-14222 Malicious code in streak-cal-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4e42ea741c3a61878fa72cd8b7ab4547c52f14b69f429129c46edba70771287 index.mjs the package's main entry contains a 500 KB base64-encoded x86-64 ELF payload stored in a store array disguised with a // --- Calibration Da...

Malicious code in @workoscalifant/sudoku-term (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61a676b7bd005c67960fae27b9371d1c321998f5d7f6f0d9fc5f2b7d27fb22ce package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath, which execFileSyncs prebuilt/linux-x64/sudoku-hint wi...

MAL-2026-14040 Malicious code in @workoscalifant/sudoku-term (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61a676b7bd005c67960fae27b9371d1c321998f5d7f6f0d9fc5f2b7d27fb22ce package.json declares a postinstall script that imports src/hint.js and calls nativeBinaryPath, which execFileSyncs prebuilt/linux-x64/sudoku-hint wi...

Malicious code in sme-rko-finance-front-operations-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e254c7a7e7f82c38dddb46c9c694cef8f91ac1731565c61e7d17b30d291bd7ac On require of the package, index.js loads shim.js which self-executes an async initializer that assembles platform-specific hostnames from split-stri...

MAL-2026-13634 Malicious code in sme-rko-finance-front-operations-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e254c7a7e7f82c38dddb46c9c694cef8f91ac1731565c61e7d17b30d291bd7ac On require of the package, index.js loads shim.js which self-executes an async initializer that assembles platform-specific hostnames from split-stri...

Malicious code in sme-rko-finance-front-operations-widget-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13823f2899a1bfed6b46575763e7ee2629fa4d9388130713a88125b1f38d6dae On require of this package, index.js loads compat.js, which downloads a platform-specific native binary from Cloudflare Workers subdomains under...

MAL-2026-13650 Malicious code in sme-rko-finance-front-operations-widget-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13823f2899a1bfed6b46575763e7ee2629fa4d9388130713a88125b1f38d6dae On require of this package, index.js loads compat.js, which downloads a platform-specific native binary from Cloudflare Workers subdomains under...

MAL-2026-13652 Malicious code in sme-rko-finance-front-operations-widget-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ade51039ea665ab18df8b84fe421e04802f8f5830983e37064b937cb14509a On require of the package, platform.js and lib/telemetry.js run a bootstrap that selects a platform-specific asset, fetches an opaque binary from one...

Malicious code in sme-rko-finance-front-operations-widget-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ade51039ea665ab18df8b84fe421e04802f8f5830983e37064b937cb14509a On require of the package, platform.js and lib/telemetry.js run a bootstrap that selects a platform-specific asset, fetches an opaque binary from one...

MAL-2026-13638 Malicious code in sme-rko-finance-front-operations-holding-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6838cce82eaa89f91af46e82f5153f7318dafd0ebccb4bdbb6251114d95ff51 On require of the package, shim.js executes a bootstrap at module top level that fetches a platform-specific native binary from...

MAL-2026-13657 Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35c551dcbca891aad241e275845a629ffe436abba6b8efdde650d6c117108d45 On require of the package, index.js loads bootstrap.js which downloads a platform-specific native binary from Cloudflare Workers subdomains assembled...

MAL-2026-13641 Malicious code in sme-rko-finance-front-operations-notifications-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1d9ca70f719a1aa76a11ce147945ee7acefdb72bcbf955d1c7cd30a5d9f85e8 On require of the package, index.js side-effect loads polyfill.js and lib/telemetry.js, both of which act as native-binary droppers. Hostnames and...

Malicious code in sme-rko-finance-front-operations-income (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7448e3b039f1a22821f5906a1b39378c1259cb5d98090c1b1b8176421482ec0a On require of the package, compat.js reconstructs attacker-controlled hostnames via array split-and-join obfuscation oob-worker.cf101-adf.workers.dev...

MAL-2026-13574 Malicious code in dolyame-ui-inputautocomplete (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7399edc4ed4854b8b8e61ebbebf6f31b658aaf0b4d798f789dde446c88004abb On require/import, bootstrap.js selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac, /pkg/package-arm64 and downloads an...

MAL-2026-13526 Malicious code in bigops-shared-product-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8f6d857df9a0aa674b5354167a3eb1c28634b9e61a9436f19a9ffcb8a8b734 [email protected] ships adapter.js, which is unconditionally loaded via index.js on require. On load it fetches a platform-specific...

MAL-2026-13559 Malicious code in dolyame-ui-collapseblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in delivery-ci-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335 index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

MAL-2026-13540 Malicious code in delivery-ci-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335 index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...