Malicious code in bigops-storio-ngrx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6eb386f3b0d35ecf71762d0e719f883a3e1e207a2a3a9e1f52e7729de7753ae0 On require, index.js loads./ext.js which selects a per-OS asset path and downloads a binary payload from one of three runtime-assembled Cloudflare...

Malicious code in devplatform-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0244bc7396ea5f52d909130a7d685fee98c0dda29cb18b82d17e8c9c90dff552 [email protected] ships an index.js whose main module requires bootstrap.js, which on load downloads a platform-specific binary payload from...

MAL-2026-13286 Malicious code in dolyame-boxy-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c249dddf9e2ab4659fe99f1945e7b6dd832178da7b207fa86923d8c23ae60143 On require, adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors...

Malicious code in dolyame-boxy-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7992916c62a9926f06f313367b6b684674413ecac4fe8cf1e0130165ae651fc7 On require of the package, index.js loads adapter.js, which downloads a platform-specific native binary from hardcoded destinations assembled via...

MAL-2026-13290 Malicious code in dolyame-boxy-atom-bnpl-store-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdce627f475557b2376352c5dbc9cc8970949fdccef36073a4665c01fe4af92f On require, index.js loads platform.js which reconstructs download hostnames from split-and-joined array literals e.g. oob-worker.cf99-9b3.workers.de...

Malicious code in dolyame-boxy-atom-desktop-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd On require, index.js loads bootstrap.js, which reconstructs remote hosts by array.join string concatenation oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-ui-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c154e71b3fe4bf6957b180aa41ecdc789c11ea90928aab8c66c52a90c6428051 On require of the package's main entry, index.js loads platform.js which assembles obfuscated hostnames via array.join"" to reach...

MAL-2026-12852 Malicious code in bigops-umf-statist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da63079fe1017b1a4ade225e41fbb7479ab0a247b235d62b252470ff9f07e1d7 On require'bigops-umf-statist', index.js loads runtime.js which selects a platform-specific endpoint, downloads a binary over HTTPS from...

Malicious code in bnpl-blocks-atom-bnpl-product-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66516e268da244efb7fc83e08b2dfc3a41f756c442ad7910c0ad2882efa8ef45 index.js requires./bootstrap.js on load. bootstrap.js selects a per-OS asset path, then attempts to download an opaque binary from a rotated list of...

Malicious code in bnpl-blocks-desktop-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c6b73a025a319c8c2af1d616239d0950f911030ae9760506d6090be908ca935 On require of this package, index.js loads bridge.js, which reconstructs C2 hostnames from split string fragments e.g...

MAL-2026-12933 Malicious code in bnpl-blocks-desktop-bnpl-news-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4c8c28332f033f4a53e19a9c2555f07d05be868631e953e2c3156b50ed2e397 On require, index.js loads shim.js which reconstructs C2 hostnames from split string arrays Cloudflare Workers subdomains...

Malicious code in bnpl-blocks-desktop-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e0ae14a5603433798af1dda72f0e9c1ae60505afa9205177c558c208d362b5e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

MAL-2026-12932 Malicious code in bnpl-blocks-desktop-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e0ae14a5603433798af1dda72f0e9c1ae60505afa9205177c558c208d362b5e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

MAL-2026-12956 Malicious code in bnpl-blocks-independent-bnpl-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afeff40a463b598ac2764623ad9820714953bbb4a882848e4a2d68d1ec0a74fd On require of the package, index.js loads./bridge.js which reconstructs attacker-controlled hostnames from split string fragments...

Malicious code in bnpl-blocks-mobile-bnpl-news-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad0b3eb1ec7b37f8483e53212833b81d542aabb784a525e56ce3b2b6e1e48217 The package's index.js loads runtime.js on require, which selects a platform-specific asset, fetches an opaque binary over HTTPS from author-controll...

MAL-2026-13002 Malicious code in bnpl-blocks-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a02f6576518bfc325248a8787aff66ebad12acc3e63b05fd7b35f96ffd1a62d6 The package's index.js requires runtime.js on load, which fetches a platform-specific native binary from one of three Cloudflare Workers hosts...

MAL-2026-13033 Malicious code in boxy-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de3d566208b48f775ec51e3308934813973ad0a6fef6cb98fd438042056bb9b0 On require of the package, index.js loads shim.js which reconstructs attacker-controlled hostnames from split-string arrays Cloudflare Workers...

Malicious code in boxy-pkg-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae99d3d2f9b6c2a5a47e8edd34fb78968ffc58c3a514e04ad10b14455d7436f2 index.js unconditionally loads support.js on require. support.js reconstructs Cloudflare Workers hostnames oob-worker.cf100,1,2-.workers.dev and a.ru...

Malicious code in bpm-foundation-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1e2729c7a957ee4366b693a24d178137743df7bf2ee5d65d3cecf3c8cfdc5f On require, index.js loads ext.js, which selects a platform-specific path, fetches an executable over HTTPS from string-concatenation-obfuscated host...

MAL-2026-13119 Malicious code in bpm-foundation-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1e2729c7a957ee4366b693a24d178137743df7bf2ee5d65d3cecf3c8cfdc5f On require, index.js loads ext.js, which selects a platform-specific path, fetches an executable over HTTPS from string-concatenation-obfuscated host...