MAL-2026-13083 Malicious code in boxy-sitree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2be12f6af3487a38f7fa17ee8a4fd8a910f9dccffa351a8e19545781b2dfd3bc Requiring boxy-sitree triggers shim.js, which selects a platform-specific binary path, fetches an executable from Cloudflare Workers hosts assembled ...

Malicious code in boxy-rspack-optimize-sharing-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4136f667c5959249d83cd2f0a7322d10c005450c7ce18ae1c1723e0a017e80 The package's index.js unconditionally requires./bridge on module load. bridge.js selects a platform-specific payload path linuxx64, linuxarm64,...

MAL-2026-13078 Malicious code in boxy-rspack-optimize-sharing-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4136f667c5959249d83cd2f0a7322d10c005450c7ce18ae1c1723e0a017e80 The package's index.js unconditionally requires./bridge on module load. bridge.js selects a platform-specific payload path linuxx64, linuxarm64,...

Malicious code in boxy-temper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3410beb63f55222c2e4d1823fae16f5de4cc07ec2ba428712d482737c72bbd2 index.js requires bridge.js on module load. bridge.js selects a platform-specific URL from a list of Cloudflare Workers hostnames whose strings are...

Malicious code in boxy-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ecbc929cc9a3cab12301c7879112bd95abb78812a0248415cc4f7c075d3eec1 On require of the package, index.js unconditionally loads compat.js, which reconstructs attacker-controlled hostnames from split string arrays...

Malicious code in boxy-validate-implicit-deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04288ec5388fa5634c253b28690e3e5b4b1220fbc9d07440fbb1c8a70860b0e5 On require of the package, index.js loads loader.js which selects a per-platform payload path and fetches an opaque binary from one of four hardcoded...

MAL-2026-13096 Malicious code in boxy-validate-implicit-deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04288ec5388fa5634c253b28690e3e5b4b1220fbc9d07440fbb1c8a70860b0e5 On require of the package, index.js loads loader.js which selects a per-platform payload path and fetches an opaque binary from one of four hardcoded...

MAL-2026-13105 Malicious code in bpm-foundation-base-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d880fad0158970d8ef9b0a0884fe6b2ceee572d3046db4cf08745d02d3c34293 On require, index.js loads helpers.js, which reconstructs C2 hostnames via string-split-join concatenation...

Malicious code in bpm-foundation-base-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d880fad0158970d8ef9b0a0884fe6b2ceee572d3046db4cf08745d02d3c34293 On require, index.js loads helpers.js, which reconstructs C2 hostnames via string-split-join concatenation...

MAL-2026-13102 Malicious code in bpm-foundation-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5 On require, index.js loads polyfill.js which performs an https.get to hardcoded Cloudflare Workers hostnames assembled by joining string fragments...

Malicious code in boxy-wrapper-rspack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c The package advertises itself as an rspack plugin but ships a stub index.js that silently requires adapter.js, which runs at module load time...

MAL-2026-13098 Malicious code in boxy-wrapper-rspack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c The package advertises itself as an rspack plugin but ships a stub index.js that silently requires adapter.js, which runs at module load time...

Malicious code in bpm-foundation-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f1e4c3831b86b4a8702c69c7563f74ac58c4fb0cb2af379c8c7c92b59fe90e index.js unconditionally requires./init.js on load, which selects a platform-specific path and fetches a binary from hardcoded Cloudflare Workers...

Malicious code in boxy-wrapper-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50 The package's main entrypoint index.js unconditionally requires./compat.js, whose top-level main reconstructs obfuscated Cloudflare Workers hosts...

Malicious code in bpm-foundation-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1e2729c7a957ee4366b693a24d178137743df7bf2ee5d65d3cecf3c8cfdc5f On require, index.js loads ext.js, which selects a platform-specific path, fetches an executable over HTTPS from string-concatenation-obfuscated host...

Malicious code in bpm-foundation-linters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7753fe48a070f467d11a5dfef041b6919ff9914df1484d0ef0e59c95f583961 On require of the package, index.js loads runtime.js which selects a per-platform payload path, fetches an opaque binary over HTTPS from one of three...

MAL-2026-13112 Malicious code in bpm-foundation-linters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7753fe48a070f467d11a5dfef041b6919ff9914df1484d0ef0e59c95f583961 On require of the package, index.js loads runtime.js which selects a per-platform payload path, fetches an opaque binary over HTTPS from one of three...

MAL-2026-13120 Malicious code in bpm-foundation-tcs-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3a42f343712987873cf8ad18e70cc172666edc3b079149cae4d449ceadf2262 On require of the package, index.js loads adapter.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts...

MAL-2026-13111 Malicious code in bpm-foundation-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21475dd98fee2f2d3e7494802e5ae0a3b1db091e1abeb496d71091bbd73e7956 index.js unconditionally requires runtime.js on module load. runtime.js selects a platform-specific endpoint /pkg/package, /pkg/package-arm64,...

MAL-2026-13122 Malicious code in bpm-ng-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 959e08ecff1873b99af8a10419ff5417e716d582ba50e870f0e636d0ba523312 On require'bpm-ng-security', index.js loads bridge.js whose top-level bootstrap fetches a platform-specific binary from anonymous Cloudflare Workers...