MAL-2026-13662 Malicious code in sme-rko-finance-front-payments-feed-display-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eedf1850bd0f58b8adef8a6b6c3ac13adf7848819306e5a7b9518cbb174911a3 On require of the package's main module, compat.js unconditionally downloads a platform-specific executable and runs it. Destination hosts are...

MAL-2026-13379 Malicious code in statist-browser-typed-client-sme.rko.tariffs.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d52851f17c7c1a340dd9999cf89369ffffd6fbe5bac9aa1b441bdc42ce320067 On require of this package, index.js loads compat.js which selects a platform-specific payload path, fetches an opaque binary over HTTPS from one of...

Malicious code in dlp-dlp-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a7f83a18ee0f4d41331997bd85740febbb8d8e581fa9026b83112e55d2b8320 On require'dlp-dlp-core', index.js loads setup.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac,...

Malicious code in dolyame-boxy-desktop-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ac9b6ff477d28984f8498e58ccc09c6addc4ecce2816fd46f25e5b4cfca49dc On require of this package, index.js loads bridge.js which auto-executes an init routine that fetches a platform-specific binary from runtime-assembl...

MAL-2026-13308 Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from...

Malicious code in bigops-ui-kit-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2db8a58fec98e1913d3aab98b7f40a0580a16aeea9b7d5af4cf560026b463ac1 On require of bigops-ui-kit-styles, index.js loads compat.js which fetches a platform-specific executable from obfuscated Cloudflare Workers subdomai...

MAL-2026-12875 Malicious code in bnpl-blocks-atom-bnpl-feedback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058b0a78e0960f56198334ba1623fa948a0b198e4480910e73e44e48ad2704d0 On require'bnpl-blocks-atom-bnpl-feedback', index.js loads bridge.js which selects a platform-specific asset, downloads an unsigned binary via HTTPS...

Malicious code in bigops-storio-schematics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85f76938cd11389b3bd414591165194a80fb7188a92630a675a68c5cdb61202b index.js unconditionally requires runtime.js, whose top-level start function selects a platform-specific asset path, fetches an opaque binary from...

MAL-2026-13000 Malicious code in bnpl-blocks-mobile-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e19ad8f13f3c9f4ab6b31c65bad3fb1239ad816c040504428eae8c32740869c index.js unconditionally requires helpers.js, which on module load fetches a platform-specific binary from string-split-obfuscated Cloudflare Workers...

MAL-2026-13046 Malicious code in boxy-fixture-pendel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbad559799410017202aafce879de36d171f9480e4cd995e4e5fe5cb3bddb830 On require'boxy-fixture-pendel', index.js loads support.js which asynchronously downloads a platform-specific binary from obfuscated destinations...

Malicious code in boxy-mm-advisor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32b540f41a9d31185da353531b46adbb4d2bc9bd9b43efb79a4f8e80fbd51f8a On require of boxy-mm-advisor, index.js loads init.js which auto-runs init. The module reconstructs C2 hostnames via array-split-and-join obfuscation...

Malicious code in boxy-wrapper-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50 The package's main entrypoint index.js unconditionally requires./compat.js, whose top-level main reconstructs obfuscated Cloudflare Workers hosts...

MAL-2026-12591 Malicious code in checkout-select-pos-offer-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25449cb8ef55958d7012b9bac4b207cf8622f79dba8e0411eac30a848df81008 index.js unconditionally requires ext.js on load, which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains...

MAL-2026-12613 Malicious code in claims-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f75c174b3db5e2480eabc7c7f8ab5e8366737fac8e76086da13f8acac6545813 On require of the package, index.js loads ext.js, which reconstructs destination hostnames from string-split arrays e.g...

Malicious code in claims-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b The package's index.js unconditionally requires./helpers.js, whose top-level main executes on import. It downloads a platform-specific binary from...

MAL-2026-12633 Malicious code in claims-payout-offer-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 850a478885db918edfa4d7ae8131202acf806c8baa7e2c973b6a5c05735b6918 On require of the package's main entry, index.js loads support.js which downloads a platform-specific binary from split/obfuscated Cloudflare Workers...

Malicious code in checkout-desktop-total (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under wel1.ru if HTTPS delivery fails. Systems that imported this package...

MAL-2026-12296 Malicious code in twork-data-services-product-design-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a86edfca41ff32a7b044ecb921977944dbdc5cf5d2a3ccae4e5ca001a851816 On require of the package's main module, loader.js downloads a platform-specific binary from a set of obfuscated Cloudflare Workers subdomains...

Malicious code in beaver-ui-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d Package advertises itself as a React UI toolkit but on require, helpers.js runs init at module load which selects a platform-specific URL, fetches a...