Malicious code in bnpl-blocks-mobile-bnpl-image-plus-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fe5dcff2d2c8210499718411ebd66f6810c42a8439728a3919636548598b494 On require of the package, compat.js assembles remote endpoint hostnames from split string arrays e.g. oob-worker.cf10x-.workers.dev and includes a D...

Malicious code in bnpl-blocks-mobile-bnpl-image-with-caption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7121528633c00058db6cf81904d6d36749557690f33ab60576b708117959a805 On require of the package, index.js loads polyfill.js which selects a platform-specific endpoint and downloads a binary over HTTPS from one of three...

Malicious code in bnpl-blocks-mobile-bnpl-tab-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34cc219a990162733e49aafc255a8abe4c4acd3fc56bce77ae31800fd4791678 On require of the package, index.js side-loads adapter.js which selects a platform-specific asset, downloads bytes over HTTPS from hostnames...

Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d On require of index.js, support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-13009 Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d On require of index.js, support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers...

Malicious code in bnpl-blocks-stories (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04845144f2e54662acd3413698e57b4efbbe44c47ddeb3c40c2fcc7383ae572c On require of the package, index.js loads./ext which reconstructs hardcoded hostnames via fragment-joined arrays e.g. oob-worker.cf99-9b3.workers.dev...

Malicious code in boxy-bus-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6494a00553cc1e8c7e5ffdd957d31a21a33ab34a252979d7d6d551239fc0f79 On require of the package, index.js loads compat.js which downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts...

Malicious code in bnpl-blocks-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5570ecd44264d28f2c2378da5c6cd23e562e696687adb01ab10b373c91e6560 On require of bnpl-blocks-types, index.js loads helpers.js which selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac,...

MAL-2026-13020 Malicious code in bnpl-blocks-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5570ecd44264d28f2c2378da5c6cd23e562e696687adb01ab10b373c91e6560 On require of bnpl-blocks-types, index.js loads helpers.js which selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac,...

Malicious code in boxy-debugger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2 boxy-debugger 35.3.4 presents itself as a debugger library, but requiring the package triggers platform.js, which reconstructs attacker-controlled...

Malicious code in boxy-deps-calculator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b0faa243ad4d8a3f6d3b76b94da84738fcd5a097efc0c2e920b4f029b76f970 setup.js runs at install time: it performs an HTTPS reconnaissance request https.get to a remote host with an identifier payload and then spawns a...

MAL-2026-13038 Malicious code in boxy-deps-calculator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b0faa243ad4d8a3f6d3b76b94da84738fcd5a097efc0c2e920b4f029b76f970 setup.js runs at install time: it performs an HTTPS reconnaissance request https.get to a remote host with an identifier payload and then spawns a...

MAL-2026-13049 Malicious code in boxy-get-retry-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bd36db17d5636ee0cd74be0ca5d35fc190e75749360c297ecd52821d74ab8b8 On require, index.js delegates to helpers.js which selects a platform-specific asset path, downloads an opaque binary over HTTPS from obfuscated...

Malicious code in boxy-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1164ada14e000c3802b5766cdd31ef169e8f15a6d132cbe52d88b0c593b03c2a On require of the package, bridge.js downloads a platform-specific binary from obfuscated Cloudflare workers.dev hosts...

MAL-2026-13069 Malicious code in boxy-mm-advisor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32b540f41a9d31185da353531b46adbb4d2bc9bd9b43efb79a4f8e80fbd51f8a On require of boxy-mm-advisor, index.js loads init.js which auto-runs init. The module reconstructs C2 hostnames via array-split-and-join obfuscation...

MAL-2026-13091 Malicious code in boxy-test-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a5cc17bc186bfb165d7341ea7832b66bc93cafaa6f849ccc840660735c0cfa5 On require of the package, index.js loads ext.js which assembles C2 hostnames from split string fragments oob-worker.cf102-baf.workers.dev,...

MAL-2026-13083 Malicious code in boxy-sitree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2be12f6af3487a38f7fa17ee8a4fd8a910f9dccffa351a8e19545781b2dfd3bc Requiring boxy-sitree triggers shim.js, which selects a platform-specific binary path, fetches an executable from Cloudflare Workers hosts assembled ...

MAL-2026-13078 Malicious code in boxy-rspack-optimize-sharing-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4136f667c5959249d83cd2f0a7322d10c005450c7ce18ae1c1723e0a017e80 The package's index.js unconditionally requires./bridge on module load. bridge.js selects a platform-specific payload path linuxx64, linuxarm64,...

MAL-2026-13081 Malicious code in boxy-semver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec5b3e90530b4252cc04b1cf4cf70ec0113fa36f307ef33b28c80ff72ebdc83 index.js unconditionally requires./init on load. init.js downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts...

Malicious code in bpm-foundation-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5 On require, index.js loads polyfill.js which performs an https.get to hardcoded Cloudflare Workers hostnames assembled by joining string fragments...