Malicious code in bnpl-blocks-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a02f6576518bfc325248a8787aff66ebad12acc3e63b05fd7b35f96ffd1a62d6 The package's index.js requires runtime.js on load, which fetches a platform-specific native binary from one of three Cloudflare Workers hosts...

MAL-2026-13002 Malicious code in bnpl-blocks-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a02f6576518bfc325248a8787aff66ebad12acc3e63b05fd7b35f96ffd1a62d6 The package's index.js requires runtime.js on load, which fetches a platform-specific native binary from one of three Cloudflare Workers hosts...

Malicious code in bnpl-blocks-seo-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fafe459f610c3c0c55f043148b4900bc1c70b4f02adfc7a440afbe115ca3b36a [email protected] declares itself an SEO tool but on module load index.js requires./support.js fetches a platform-specific native binary...

MAL-2026-13016 Malicious code in bnpl-blocks-seo-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fafe459f610c3c0c55f043148b4900bc1c70b4f02adfc7a440afbe115ca3b36a [email protected] declares itself an SEO tool but on module load index.js requires./support.js fetches a platform-specific native binary...

MAL-2026-13013 Malicious code in bnpl-blocks-post-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd5d8d3c9328912323fee5066e4c32c14904ec3e8b1800f66da0d1749babda0c On require, polyfill.js reconstructs attacker-controlled hostnames from string-split fragments oob-worker.cf103-070.workers.dev, with a DNS-TXT...

Malicious code in bnpl-blocks-post-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd5d8d3c9328912323fee5066e4c32c14904ec3e8b1800f66da0d1749babda0c On require, polyfill.js reconstructs attacker-controlled hostnames from string-split fragments oob-worker.cf103-070.workers.dev, with a DNS-TXT...

Malicious code in bnpl-blocks-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a0a2e3786f50dc07b4546de5ae22f3a65ad50e95897b8ca4d0fa6460b32d63 On require of bnpl-blocks-scroll, index.js loads helpers.js, which selects a platform-specific payload path and fetches an opaque native executable v...

MAL-2026-13035 Malicious code in boxy-cook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 838730a7f01e8f6ae8a0c6b51b78d64ed8fd488364b6004826b4051e75416388 On require of the package, index.js loads polyfill.js which fetches a platform-specific native binary and executes it. Destination hostnames are...

Malicious code in boxy-debugger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2 boxy-debugger 35.3.4 presents itself as a debugger library, but requiring the package triggers platform.js, which reconstructs attacker-controlled...

MAL-2026-13036 Malicious code in boxy-debugger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2 boxy-debugger 35.3.4 presents itself as a debugger library, but requiring the package triggers platform.js, which reconstructs attacker-controlled...

Malicious code in boxy-maker-extendable-minihost (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08404cdfbfce9c8e1f4d6b5c4597504b8d1ee580eabfaa960e5d928b4d5505a4 On require, index.js loads bridge.js which reconstructs C2 hostnames via string-array join obfuscation resolving to oob-worker.cf101-3-.workers.dev...

MAL-2026-13059 Malicious code in boxy-maker-extendable-minihost (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08404cdfbfce9c8e1f4d6b5c4597504b8d1ee580eabfaa960e5d928b4d5505a4 On require, index.js loads bridge.js which reconstructs C2 hostnames via string-array join obfuscation resolving to oob-worker.cf101-3-.workers.dev...

MAL-2026-13063 Malicious code in boxy-maker-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a06d379928c2633009c8dc7d89921205689ffb6ed8fa03ba74f67f557836c6f4 [email protected] executes a remote binary dropper the moment the module is loaded. index.js unconditionally requires polyfill.js, which selec...

Malicious code in boxy-mif-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4e9fe90e4c6a7334c75fffb7bd07fdeb785a35b9fc2c1a9e5ce74265296d1c7 On require of this package, index.js loads bridge.js which downloads a platform-specific native executable from string-split obfuscated Cloudflare...

MAL-2026-13068 Malicious code in boxy-mif-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4e9fe90e4c6a7334c75fffb7bd07fdeb785a35b9fc2c1a9e5ce74265296d1c7 On require of this package, index.js loads bridge.js which downloads a platform-specific native executable from string-split obfuscated Cloudflare...

MAL-2026-13077 Malicious code in boxy-render-unwrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26755161d9a2ac85d670783fc7eb67383b08592dbb67899b916d3e521d560420 On require of boxy-render-unwrap, index.js loads bootstrap.js which selects a platform-specific payload URL from a set of obfuscated mirror hosts...

Malicious code in boxy-mmb-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f98f3a2dd8ca593bdd127f3fd631a10fe4a3c70f57890aa43e2da45b92d18d80 index.js unconditionally requires loader.js on module load. loader.js reconstructs hostnames by joining split string fragments evading static grep to...

Malicious code in boxy-test-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a5cc17bc186bfb165d7341ea7832b66bc93cafaa6f849ccc840660735c0cfa5 On require of the package, index.js loads ext.js which assembles C2 hostnames from split string fragments oob-worker.cf102-baf.workers.dev,...

MAL-2026-13091 Malicious code in boxy-test-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a5cc17bc186bfb165d7341ea7832b66bc93cafaa6f849ccc840660735c0cfa5 On require of the package, index.js loads ext.js which assembles C2 hostnames from split string fragments oob-worker.cf102-baf.workers.dev,...

Malicious code in bpm-foundation-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da9be4e91e8e8a5c0eea771a43103f8fde8202cd1a817fa7d511d8ab81788442 On require'bpm-foundation-auth', index.js loads adapter.js which selects a platform-specific asset and downloads an opaque native binary over HTTPS...