Malicious code in bigops-status-selection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00ac52845dd473e3c39d37b9f3916ed67f48cabfb276bc8cc2e9ca2dca401ce5 On require, bootstrap.js selects a platform-specific path, fetches a binary from one of three hardcoded .workers.dev hosts...

MAL-2026-13283 Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

MAL-2026-13297 Malicious code in dolyame-boxy-atom-icon-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34c580f021e76e3cff3c4a92cac6c53ef918c49db3c1d0b8eae008dd51dca766 Package advertised as an icon loader but on require the bundled vendor.js downloads a platform-specific executable from obfuscated Cloudflare...

Malicious code in dolyame-boxy-atom-icon-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34c580f021e76e3cff3c4a92cac6c53ef918c49db3c1d0b8eae008dd51dca766 Package advertised as an icon loader but on require the bundled vendor.js downloads a platform-specific executable from obfuscated Cloudflare...

Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from...

Malicious code in dolyame-boxy-desktop-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee The package main index.js requires ./init on load. init.js assembles hostnames via string-split .join'' obfuscation to produce a rotating list of...

MAL-2026-13311 Malicious code in dolyame-boxy-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3 On require of dolyame-boxy-fonts, index.js unconditionally loads./loader.js, which reconstructs C2 hostnames from split-string arrays Cloudflare...

MAL-2026-13322 Malicious code in dolyame-boxy-independent-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3d08e3dbef59d66846b1b2ef0080f02c8f2c3597eb4725db3c6f62c8fcb231 index.js unconditionally requires./loader on load. loader.js selects a platform-specific payload path linuxx64, linuxarm64, darwin, win32 and downloa...

Malicious code in dolyame-boxy-independent-bnpl-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f29e1e3b6b3a01a935dbcd19077e516c17d31c3674078ecfe2cd112b0137437 On require, index.js loads init.js which reconstructs hostnames from split-string arrays e.g. 'oob-worker.cf102','-baf.workers.','dev'.join'' and...

MAL-2026-12822 Malicious code in beaver-ui-search-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 117b4f6c7e9e402d92085e427c4b40874e9b6838e16c15562408a0bda241f9ae The package presents itself as a UI dropdown library but on require executes init.js, which selects a platform-specific asset linux/darwin/win32,...

Malicious code in bigops-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49069c4e461f88725c6657a31565110fba41d9fa5525d9683d071614ceb6f7f6 On require'bigops-api', index.js loads compat.js which detects OS/arch, downloads a platform-specific binary from runtime-assembled hostnames fragmen...

MAL-2026-12832 Malicious code in bigops-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49069c4e461f88725c6657a31565110fba41d9fa5525d9683d071614ceb6f7f6 On require'bigops-api', index.js loads compat.js which detects OS/arch, downloads a platform-specific binary from runtime-assembled hostnames fragmen...

MAL-2026-12843 Malicious code in bigops-telephony-ui-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95bba7270d3de4aa970aefb0ef6b0017f4d9663219dd0eccbb44b5d3c9dd6f6a The package main index.js unconditionally requires init.js, which on module load selects a platform-specific asset linuxx64, linuxarm64, darwin, win3...

Malicious code in bigops-telephony-ui-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95bba7270d3de4aa970aefb0ef6b0017f4d9663219dd0eccbb44b5d3c9dd6f6a The package main index.js unconditionally requires init.js, which on module load selects a platform-specific asset linuxx64, linuxarm64, darwin, win3...

Malicious code in bigops-telephony-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93b10fc5eff860f82de5bc03b910dbe2b96b06d54c22741cbb593b007dd9ee38 On require of the package, shim.js downloads a platform-specific executable over HTTPS from string-concatenated hostnames...

MAL-2026-12819 Malicious code in beaver-ui-object-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a2a78be16248a4269fca22b39cf436f82f26818c797949af73eca331cc3a0f6 On require'beaver-ui-object-card', index.js loads ext.js which selects a platform-specific asset path and downloads an unsigned native binary from...

MAL-2026-12854 Malicious code in bigops-videocalls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b04bc16010479f488969366f0af5596c33f668da075e09d5d1b8fad737f03cd On require of the package's main entry, support.js executes at import time: it selects a platform-specific path, fetches an opaque native binary from...

Malicious code in bigops-watchdog-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65df39f269239434211427140c77c096d41d8de8800667ef39a27bf89572c67 On require of bigops-watchdog-worker, index.js loads runtime.js which reconstructs remote hostnames from split-string fragments e.g. joining...

MAL-2026-12856 Malicious code in bigops-watchdog-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65df39f269239434211427140c77c096d41d8de8800667ef39a27bf89572c67 On require of bigops-watchdog-worker, index.js loads runtime.js which reconstructs remote hostnames from split-string fragments e.g. joining...

MAL-2026-12867 Malicious code in bnpl-blocks-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5510d446112b9ad4b6de3da9fa7128566dc13de6707bc0d627940344f8c7322d On require of this package, runtime.js downloads a platform-specific executable from string-split-obfuscated hosts under oob-worker.cf10x-.workers.de...