Malicious code in sme-rko-finance-front-operations-income (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7448e3b039f1a22821f5906a1b39378c1259cb5d98090c1b1b8176421482ec0a On require of the package, compat.js reconstructs attacker-controlled hostnames via array split-and-join obfuscation oob-worker.cf101-adf.workers.dev...

MAL-2026-13639 Malicious code in sme-rko-finance-front-operations-income (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7448e3b039f1a22821f5906a1b39378c1259cb5d98090c1b1b8176421482ec0a On require of the package, compat.js reconstructs attacker-controlled hostnames via array split-and-join obfuscation oob-worker.cf101-adf.workers.dev...

Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4554e1a911548ca2145464d06bcd3c66d69c9fb307a1df557924fb89b3e8c7fd On require of the package, index.js loads bootstrap.js which selects a payload path based on process.platform/arch linuxx64, linuxarm64, darwin, win3...

MAL-2026-13655 Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4554e1a911548ca2145464d06bcd3c66d69c9fb307a1df557924fb89b3e8c7fd On require of the package, index.js loads bootstrap.js which selects a payload path based on process.platform/arch linuxx64, linuxarm64, darwin, win3...

MAL-2026-13557 Malicious code in dolyame-ui-checkablegroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js...

Malicious code in dolyame-ui-inputbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c05d783314187af31df2f0152cc2809660ec45808c3e5f38071e8bfe7ac08dd6 On require of the package, index.js loads loader.js and lib/telemetry.js, both of which act as remote-binary droppers. Hostnames and dangerous API...

MAL-2026-13506 Malicious code in dolyame-ui-inputbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c05d783314187af31df2f0152cc2809660ec45808c3e5f38071e8bfe7ac08dd6 On require of the package, index.js loads loader.js and lib/telemetry.js, both of which act as remote-binary droppers. Hostnames and dangerous API...

Malicious code in bigops-logs-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5a922558781f9614bc47976e2e695cc8a5996ef51865fb5b37928f842718b5d On require of bigops-logs-player, index.js loads polyfill.js, which reconstructs a list of Cloudflare Workers hostnames...

Malicious code in dolyame-boxy-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 919c54c4e8e0b08b62f76b85369a9033929f8ea19dfc777b8ece48697229a5ce [email protected] ships a runtime.js module that is unconditionally required from index.js at load time. On import, runtime.js reconstructs...

MAL-2026-13298 Malicious code in dolyame-boxy-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 919c54c4e8e0b08b62f76b85369a9033929f8ea19dfc777b8ece48697229a5ce [email protected] ships a runtime.js module that is unconditionally required from index.js at load time. On import, runtime.js reconstructs...

Malicious code in dolyame-boxy-independent-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation...

Malicious code in dolyame-boxy-independent-bnpl-mobile-application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31565660321da87adf5d579f4608cd6059c88afd2c95a04eb7223031881572f7 The package's top-level index.js unconditionally requires./platform on load. platform.js reconstructs a set of mirror hostnames via string-split...

Malicious code in dolyame-boxy-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd3ad7593e26ae49876e0310a51ac122ddcb6878eefddc74a5828cce061d200b On require of the package, index.js loads init.js which assembles obfuscated Cloudflare Workers hostnames oob-worker.cf.workers.dev from string-split...

Malicious code in dolyame-ui-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d74520fb069fe50500e9094c4e509d06ab266bda101111701e409951e08053e9 On require of the package, index.js loads shim.js which selects a platform-specific asset path, downloads a binary from one of four hardcoded...

MAL-2026-13158 Malicious code in dolyame-ui-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 714598919807b4143a734772e690ff94aa986fb6cf61bd99026e7f7bc93f4cf2 On require of the package's main entry, loader.js runs a platform-detecting downloader that fetches an executable from obfuscated hostnames...

MAL-2026-13180 Malicious code in dolyame-ui-react-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67a3c87278303f582f0f5f046a5edcaf081cd71ed9c00906d36d3bbba5911a33 On require, index.js loads helpers.js which runs setup at module load. The setup routine reconstructs mirror hostnames at runtime by joining split...

Malicious code in dolyame-ui-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c154e71b3fe4bf6957b180aa41ecdc789c11ea90928aab8c66c52a90c6428051 On require of the package's main entry, index.js loads platform.js which assembles obfuscated hostnames via array.join"" to reach...

MAL-2026-13187 Malicious code in dolyame-ui-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c154e71b3fe4bf6957b180aa41ecdc789c11ea90928aab8c66c52a90c6428051 On require of the package's main entry, index.js loads platform.js which assembles obfuscated hostnames via array.join"" to reach...

Malicious code in bnpl-blocks-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd082c1e27c32145bec8b47cf81fa12cde384fd542629dd340c514d71728f8 On require, index.js loads ext.js which assembles Cloudflare Workers hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

MAL-2026-12865 Malicious code in bnpl-blocks-atom-bnpl-base-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7ff15e65896892e348d28080e20d974d32a0f8cd2bb5b523e63b9b3d35395e3 On require of the package, index.js loads polyfill.js, which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev,...