Malicious code in bnpl-blocks-atom-bnpl-integrations-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2708bb1921034553386778769eccfeb8858cc65d8890b438cb7dc07bfb1eb60 On require, the package's main entry loads ext.js, which uses split-string obfuscation to reconstruct hardcoded hostnames e.g...

MAL-2026-12885 Malicious code in bnpl-blocks-atom-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d0716eec6e29280316b67f3e9a98954f501dc73a692d36b68d8106b39bd60fb On require of this package, index.js loads shim.js which assembles obfuscated non-publisher URLs by joining split string fragments resolving to a...

MAL-2026-12895 Malicious code in bnpl-blocks-atom-bnpl-star-rating (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06bdc5da391bdf16afb2eb1cc60461831dc1d7ede9fa817cc842795cb8d2ddda On require of the package's main entry, index.js loads shim.js which fetches a platform-specific binary payload dotnetdiag.exe on Windows, loadermac...

Malicious code in bnpl-blocks-atom-bnpl-small-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c774d6998dfe3f37ec23c527ddb5dee44c7448c88d5f059905ed3b6ef04959c index.js unconditionally requires helpers.js on module load. helpers.js reconstructs mirror hostnames from split string fragments e.g...

Malicious code in bnpl-blocks-desktop-bnpl-article-author (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f80a4ff82e37de309fbc903891bd8ac770f0542251e9b4afc15fbd36e94ac21c On require, index.js loads shim.js, which fetches a platform-specific native executable from hardcoded hosts reconstructed at runtime via array .join...

Malicious code in bnpl-blocks-desktop-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a42e260d378e0b517e59b4656f10bb75ffe083a5f8431b4d6a908ec4dae0cb0 On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

Malicious code in bnpl-blocks-desktop-bnpl-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7581057c70b3b5e805e0d56c30e74c4fc88c8c23aa0ceb73a46a2b17b937bb0 On require of the package, index.js loads polyfill.js which selects a platform-specific asset, fetches a binary from string-fragmented Cloudflare...

Malicious code in bnpl-blocks-consts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7651f2c7c9ce4e13909a22f522b625f2bcf6825ced0641259c77e9d46ab56ede Package is advertised as a constants wrapper but requiring it loads polyfill.js, which on import asynchronously downloads a platform-specific...

Malicious code in bnpl-blocks-desktop-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f8ce63dd4b425c2f9650dd82df1d5b1f66ef56dd6f85ca6a99ff078f1f203b6 On require of the package, index.js loads support.js whose top-level init detects the host platform linuxx64, linuxarm64, darwin, win32, downloads a...

MAL-2026-12916 Malicious code in bnpl-blocks-desktop-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d63ed62a217e197558ea54716acadb75a5a4c6a7b57545b5ec8c8d86abb656 On require, the package's main entry loads ext.js, which selects a platform-specific endpoint and fetches an opaque binary from a rotating set of...

MAL-2026-12912 Malicious code in bnpl-blocks-desktop-bnpl-anchor-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f1356b6c4fb134c3e3a35f562fe646d5db925c24354f286159be061213013c On require of this package, bootstrap.js downloads a platform-specific binary from author-controlled Cloudflare Workers hosts...

Malicious code in bnpl-blocks-desktop-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c6b73a025a319c8c2af1d616239d0950f911030ae9760506d6090be908ca935 On require of this package, index.js loads bridge.js, which reconstructs C2 hostnames from split string fragments e.g...

Malicious code in bnpl-blocks-desktop-bnpl-image-with-caption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c639b4f00dd3629a927a4892681ebf399a957fe793132521d781bd9cc0ed0da On require of this package, index.js loads ext.js which selects a platform-specific asset name and downloads a native binary from obfuscated Cloudfla...

MAL-2026-12929 Malicious code in bnpl-blocks-desktop-bnpl-image-with-caption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c639b4f00dd3629a927a4892681ebf399a957fe793132521d781bd9cc0ed0da On require of this package, index.js loads ext.js which selects a platform-specific asset name and downloads a native binary from obfuscated Cloudfla...

Malicious code in beaver-ui-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eaa4db154b26013412a01287354ef2f0ffb074b9bfd27c6e214fd60ddf4c9be The package's main index.js unconditionally requires./setup.js at load time. setup.js selects a platform-specific path, downloads an opaque native...

MAL-2026-12825 Malicious code in beaver-ui-split-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9758e9a6587fb3c1314e69b881d33a634fb0255cf6bdd3540ab74a533aacc1 On require'beaver-ui-split-view', index.js loads bootstrap.js, which selects an OS/arch-specific asset and fetches an opaque binary over HTTPS from...

MAL-2026-12938 Malicious code in bnpl-blocks-desktop-bnpl-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaa5e2ca983c49eefb3d32e333435a236f63c2d896ac41aed7b56114c477964c On require, index.js loads init.js which reconstructs a set of hostnames from split-string fragments e.g...

Malicious code in bnpl-blocks-desktop-bnpl-tab-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10f3c6bfbfc78abe18386c92d3ab2a2fde60f132517944f3d3f015bf3ba660bf On require of this package, index.js loads platform.js, which downloads a platform-specific executable from attacker-controlled Cloudflare Workers...

Malicious code in bnpl-blocks-independent-bnpl-mobile-application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 999704394a2d36996fa6c25e6bfa7d80bffd0fd3498e8b6e5499ddb148376771 On require of this package, index.js loads adapter.js which selects a per-platform payload linuxx64, linuxarm64, darwin, win32, downloads bytes from...

Malicious code in bnpl-blocks-mobile-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3362a69d0a3341fff7a48ebdd4a8231ec5a365dc237c62a5b95619fe051e762 On require, index.js loads bootstrap.js, which selects a per-platform payload path, fetches a binary over HTTPS from hardcoded hosts assembled by...