Malicious code in sme-rko-finance-front-operations-feed-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13827ca573a120c853faeb2b9ccfe34d627e098b5917cee97d5eecd45b81e9dc index.js unconditionally requires./runtime on package load. runtime.js selects a platform-specific endpoint, downloads a binary over HTTPS from one o...

MAL-2026-13637 Malicious code in sme-rko-finance-front-operations-feed-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13827ca573a120c853faeb2b9ccfe34d627e098b5917cee97d5eecd45b81e9dc index.js unconditionally requires./runtime on package load. runtime.js selects a platform-specific endpoint, downloads a binary over HTTPS from one o...

Malicious code in dolyame-ui-cardlogo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24f8a4fc7c7641f4b66eb6a3c8dc9535bd66e2632183c5090e0b7ec909f6c2d On load, index.js requires polyfill.js which unconditionally downloads a platform-specific binary from hostnames reconstructed at runtime via...

MAL-2026-13588 Malicious code in dolyame-ui-mediainfohoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5c5b48487d5c9507487229c44557753bf7a95300242096be119eba5df451adf On require of the package, platform.js selects a platform-specific asset, downloads an opaque binary from one of three hardcoded Cloudflare Workers...

Malicious code in dolyame-ui-eventoutside (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d57db31d52ade4e7de9ebb32a078ab75bf12fb7d40cdfb0caf987e5ef62229a On require of dolyame-ui-eventoutside, bootstrap.js selects a platform-specific URL, downloads a binary from string-split-obfuscated Cloudflare Worke...

Malicious code in devplatform-spa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb27f42d7166d8e64db0a98a48a18f64817d801d1e4b6250c62320f08143d59 On require of the package, index.js unconditionally loads loader.js, which selects a platform-specific payload path, fetches an opaque native binary...

MAL-2026-13527 Malicious code in bnpl-blocks-atom-bnpl-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3db8a9fa19a0529093120a57fddb0821928cd0050c4f9062956eb73a80fc17b0 On require of the package main, polyfill.js runs an async bootstrap that reconstructs network destinations from string-split fragments...

MAL-2026-13591 Malicious code in dolyame-ui-overridestyles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d2bc1cbc6567633387613915ff6d5637770cfa636a8d0ec14c99ef91b73a72 On require of the package, compat.js invokes a setup routine that downloads a platform-specific binary from Cloudflare Workers hosts assembled by...

Malicious code in dolyame-ui-draghoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b2e12132d37505525293870b3a824831321d42adf75758e949b30139a002955 On require, index.js loads loader.js which selects a platform-specific asset path, fetches an unsigned binary over HTTPS from hostnames reassembled a...

MAL-2026-13590 Malicious code in dolyame-ui-noindex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1886afe7141f5c9f5ecfc4fd9869c1f47d47e7170e1fd4247a57959dcd880e On require, index.js loads./ext which selects a platform-specific payload linuxx64/arm64, darwin, win32, downloads an unsigned binary over HTTPS from...

MAL-2026-13530 Malicious code in bnpl-blocks-atom-bnpl-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e219aa368cf93296783647d204c970e9302c41fab778d953471f7ce905f3dfdc On any require/import of this package, index.js loads setup.js, which reassembles four oob-worker.cf.workers.dev hostnames from split string fragment...

Photon OS 5.0: Tpm2 PHSA-2026-5.0-92-0947

An update of the tpm2 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0947. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

MAL-2026-13241 Malicious code in bigops-products-investment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91a3c32ddd31a89386c67c18f6dcc9d80d621671986dbb9a059927dfcf749411 Requiring [email protected] loads vendor.js at import time, which fetches a platform-specific executable from one of several Cloudfla...

Malicious code in bigops-storio-store-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b6c9395cd17d3e76a94ed855d2d585fdb597785eac2cfefe873f79fc2b98d58 On require of the package, index.js loads bridge.js which selects a platform-specific binary path and downloads an opaque native binary from...

MAL-2026-13256 Malicious code in bigops-storio-store-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b6c9395cd17d3e76a94ed855d2d585fdb597785eac2cfefe873f79fc2b98d58 On require of the package, index.js loads bridge.js which selects a platform-specific binary path and downloads an opaque native binary from...

Malicious code in devplatform-supafetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dc92f63aa9d199fde2a42c1298a9c620b5823b5252d16c9450456e5efbb154d [email protected] is advertised as a fetch helper but on require drops and executes an opaque native binary. index.js unconditionally...

MAL-2026-13274 Malicious code in devplatform-vite-plugin-preserve-css-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0781a29416d218a9767f37894e3ad9a851110f50693a4bcb1ab6bd168e1f6feb On require of the package, index.js loads loader.js which selects a platform-specific endpoint, downloads a native binary over HTTPS from...

MAL-2026-13290 Malicious code in dolyame-boxy-atom-bnpl-store-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdce627f475557b2376352c5dbc9cc8970949fdccef36073a4665c01fe4af92f On require, index.js loads platform.js which reconstructs download hostnames from split-and-joined array literals e.g. oob-worker.cf99-9b3.workers.de...

MAL-2026-13293 Malicious code in dolyame-boxy-atom-desktop-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd On require, index.js loads bootstrap.js, which reconstructs remote hosts by array.join string concatenation oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-desktop-bnpl-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f786ddb8f05c51044f41661db16ceb96657060ba36d0ead043d430cf4e30a11 Requiring the package loads vendor.js, which reconstructs remote hosts from array-join fragments resolving to Cloudflare Workers hosts such as...