Malicious code in yakuza0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9952a92dd18e2353ebb4f2d8064884e7be770d23770096af6dbe1844d8b5fd6 The package ships code that binds outbound network calls to a hardcoded non-standard host, https://registry-pxnpm.rdc.nfjbill.ren, from cli/index.js...

MAL-2026-13605 Malicious code in yakuza0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9952a92dd18e2353ebb4f2d8064884e7be770d23770096af6dbe1844d8b5fd6 The package ships code that binds outbound network calls to a hardcoded non-standard host, https://registry-pxnpm.rdc.nfjbill.ren, from cli/index.js...

MAL-2026-13576 Malicious code in dolyame-ui-inputcount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7a3d0d930d73916ee9555c5a2c1ca8596f25a4336041d881f268504ad8fab06 On require of the package, helpers.js runs a setup routine that detects host OS/architecture, downloads a platform-specific binary from one of four...

MAL-2026-13562 Malicious code in dolyame-ui-contextmenusearchable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 391ae77ec9b34917f01d44186bbafde2f290fc34d102a16a6106ef2a484314a0 On require, shim.js reconstructs hostnames via string concatenation to hide destinations oob-worker.cf.workers.dev, with a DNS TXT-record base64...

Malicious code in dolyame-ui-controlgroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 099af2a758510302726d266aeefb46cb91473a6a42c9484e068f465ea1509e84 On require of dolyame-ui-controlgroup, compat.js selects a per-OS/arch URL and downloads a native binary from string-split-obfuscated hostnames...

MAL-2026-13570 Malicious code in dolyame-ui-focusstatehoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b117a5b8b618c0597bcc422e68216cd3626389417aec2940febf447c033a88 On require of the package's main entry index.js, compat.js and lib/telemetry.js run a bootstrap routine that downloads a platform-specific binary...

Malicious code in dolyame-ui-carouselline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7712f1618991466bc33076081db37dd883be10f4c0c4308fe66216cece89a03 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct destination hostnames from string arrays e.g...

Malicious code in dolyame-ui-postcssconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beadfa2b3e85781a408e7ecf6c37dc663a318fa807de81a01f85add1e195cc51 On require of the package, index.js loads polyfill.js and lib/telemetry.js, both of which fetch a platform-specific binary over HTTPS from one of fou...

Malicious code in dolyame-ui-pageheader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7db486beb59bdbcb457c1ab82344d60854b4fdd7c89a535a33f6a23fe55547e The package advertises itself as 'Common TypeScript definitions' but its main entry index.js unconditionally requires./bridge on load. bridge.js...

MAL-2026-13588 Malicious code in dolyame-ui-mediainfohoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5c5b48487d5c9507487229c44557753bf7a95300242096be119eba5df451adf On require of the package, platform.js selects a platform-specific asset, downloads an opaque binary from one of three hardcoded Cloudflare Workers...

Malicious code in dolyame-ui-dataqa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c924fc6297738267a66dffbb2d06dcca26e888b5c3abd1f10b20c22faa3e3b7 On require of index.js, the package loads polyfill.js and lib/telemetry.js which download a platform-specific native binary from Cloudflare Workers...

MAL-2026-13545 Malicious code in devplatform-spa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb27f42d7166d8e64db0a98a48a18f64817d801d1e4b6250c62320f08143d59 On require of the package, index.js unconditionally loads loader.js, which selects a platform-specific payload path, fetches an opaque native binary...

Malicious code in dolyame-ui-memoizeweak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89cabf491f2003602b491a95e2f258760c5f92aa681b87c239c755aa875b352b On require of the package, index.js loads./helpers.js which downloads a platform-specific executable from one of several hardcoded Cloudflare Workers...

Malicious code in ded-pwa-test-pub-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g...

MAL-2026-13537 Malicious code in ded-pwa-test-pub-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g...

Malicious code in dolyame-ui-tabslayout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb9bd9546be2ed0456e30701775450a1ee33b0caf58387ba91db7018f7d70bcd On require of the package, index.js loads lib/telemetry.js and polyfill.js, both of which contain dropper logic that selects an OS-specific path,...

MAL-2026-13544 Malicious code in devplatform-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de0fcdb30a4308ee477f432e1bcc665e8ee45f3dd36dd02f22089a4b9e2a69f9 [email protected] ships no ESLint configuration despite its name and description. Requiring the package loads compat.js, which on impo...

MAL-2026-13525 Malicious code in bigops-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4eccfe477123e2d048f10c141165dec00f0ce2bfe28b7b9611a189fc63f0384 On require'bigops-security', index.js loads bridge.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts...

MAL-2026-13506 Malicious code in dolyame-ui-inputbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c05d783314187af31df2f0152cc2809660ec45808c3e5f38071e8bfe7ac08dd6 On require of the package, index.js loads loader.js and lib/telemetry.js, both of which act as remote-binary droppers. Hostnames and dangerous API...

Malicious code in dolyame-ui-inputpassword (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbe3efece732cd0eab0df9c3fa387540804b7a1f7a911a340c3852e7f2c54674 On require of the package, index.js loads lib/telemetry.js which, together with bootstrap.js, fetches a platform-specific binary from a rotating list...