MAL-2026-13141 Malicious code in dolyame-ui-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a12afad0ec2643334f24431df3b2ba84584a9569bca025b50ef52feb6b9493 On require of the package's main entry, shim.js selects a platform-specific payload path and downloads a native binary from one of three Cloudflare...

Malicious code in dolyame-ui-clickable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f92051e4b21bd0bc9562833662ba7e1e9185bc8342bcc8bbbac8fc4d848c4dbe On require of the package, index.js unconditionally loads init.js, which selects a platform-specific endpoint linuxx64, linuxarm64, darwin, win32 and...

Malicious code in dolyame-ui-confirmation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dba60f94522cc371a13cce00e6a8e51678812f3f50f3e577fd5e9275295a72e0 [email protected] ships a shim.js that is required from index.js at module load. On import, shim.js detects the host OS/architecture,...

MAL-2026-13148 Malicious code in dolyame-ui-confirmation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dba60f94522cc371a13cce00e6a8e51678812f3f50f3e577fd5e9275295a72e0 [email protected] ships a shim.js that is required from index.js at module load. On import, shim.js detects the host OS/architecture,...

MAL-2026-13166 Malicious code in dolyame-ui-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e3316d577d11997d6d21e26dc346cf8f3cdb986d4e61d7ac95dac0c3eda7ba On require'dolyame-ui-loader', index.js triggers shim.js which selects a platform-specific binary path, downloads a binary over HTTPS from one of...

Malicious code in dolyame-ui-label (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdcede6d4d42bfed7f10577346b24e9af22655e50f8d454baab6f4999e6020f3 dolyame-ui-label 35.7.8 is not a UI component library. On require of the package, index.js loads helpers.js, which reconstructs C2 hostnames at runti...

MAL-2026-13162 Malicious code in dolyame-ui-label (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdcede6d4d42bfed7f10577346b24e9af22655e50f8d454baab6f4999e6020f3 dolyame-ui-label 35.7.8 is not a UI component library. On require of the package, index.js loads helpers.js, which reconstructs C2 hostnames at runti...

Malicious code in dolyame-ui-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27d450fda6c199002bb4eb20b3bf624e31393ae3ed30e9a36fce17507472b962 Package advertises itself as a UI notification toolkit but its main entry requires./compat.js, which on load randomly selects a destination from four...

Malicious code in dolyame-ui-money (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df3e9dd433a891fcca85ed4a7302185b3eccece39df2db60ab540b0ebed8631b On require of this package, index.js unconditionally loads bridge.js, which downloads a platform-specific native executable from Cloudflare Workers...

Malicious code in dolyame-ui-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cecad37efa23b83ead95d73e1b0ef07dbb8473dfd76645f4ceed5cf7939653f4 The package is published as a React UI component library but on require'dolyame-ui-menu', index.js loads polyfill.js which fetches a platform-specifi...

MAL-2026-13167 Malicious code in dolyame-ui-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cecad37efa23b83ead95d73e1b0ef07dbb8473dfd76645f4ceed5cf7939653f4 The package is published as a React UI component library but on require'dolyame-ui-menu', index.js loads polyfill.js which fetches a platform-specifi...

MAL-2026-13185 Malicious code in dolyame-ui-stepper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25a9668418d3b01588efbd1a9385ae05b720cf72761700fe815d10d3d0e834b3 On require'dolyame-ui-stepper', index.js unconditionally loads shim.js, which assembles hostnames from split string fragments resolving to...

Malicious code in dolyame-ui-swiper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d7b18729a9aed582b73ddcfb2c332aba97810caa9daea155e62fd4035158a8a On require of the package's main entry, bridge.js unconditionally runs an init routine that selects an OS-specific target path, downloads an opaque...

MAL-2026-13188 Malicious code in dolyame-ui-swiper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d7b18729a9aed582b73ddcfb2c332aba97810caa9daea155e62fd4035158a8a On require of the package's main entry, bridge.js unconditionally runs an init routine that selects an OS-specific target path, downloads an opaque...

MAL-2026-12827 Malicious code in beaver-ui-subheader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b62336df8b8ee0e1bd3939f4515a4b25dd6741773f30344cd3a0d065d16358fb The package advertises itself as a UI subheader component, but index.js requires./support on load and support.js downloads a platform-specific binary...

Malicious code in bigops-api-customer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41f35d0e9c1c32b6937135731889f5494483108bf0cf449fc19e5b4cecc4a002 On require of bigops-api-customer, index.js loads compat.js which downloads an OS-specific native binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12833 Malicious code in bigops-api-customer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41f35d0e9c1c32b6937135731889f5494483108bf0cf449fc19e5b4cecc4a002 On require of bigops-api-customer, index.js loads compat.js which downloads an OS-specific native binary from obfuscated Cloudflare Workers hosts...

Malicious code in bigops-tasks-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08e2dc270f95427849a0d3560958c363536ef336456a15337845969b682e9e68 On require of the package, index.js unconditionally loads compat.js, which downloads a platform-specific binary from obfuscated Cloudflare Workers...

Malicious code in bigops-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80be948322937758b568e63d82d769aa07a443a3b849cf19fd440ed5bf4505ec On require'bigops-tasks', index.js side-effect loads vendor.js which downloads a platform-specific native binary from string-fragment-obfuscated...

MAL-2026-12837 Malicious code in bigops-tcrm-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f4cc9ef61d16a5c70a1adc9c2ab3acb9e51d650967f02621410285d99efd4a1 The package's main index.js requires./setup on load. setup.js selects a platform-specific payload path, downloads a native binary over HTTPS from...