MAL-2026-12690 Malicious code in deposits-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6d03bd134745bb66c8ba26a5ee1ddd2f9417eab449bd8ca7a4c649064cf38f1 index.js requires./support on module load. support.js reconstructs obfuscated hostnames via string split-and-join oob-worker.cf101-adf.workers.dev,...

MAL-2026-12668 Malicious code in custom-plugins-request-factory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c25a4c4f3672ed82aa59bcac3fff0c6eadcb3eb35add0f52155c4436cba62c52 The package's main entry auto-requires setup.js on load, which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers...

MAL-2026-12675 Malicious code in ded-pwa-bnpl-forms-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3094b607c6a3b342b1e8a4d7a3acde686d9fba41a68d430e08cda12dd9b0bca On require of the package, index.js loads support.js which executes at import time: it selects a platform-specific output path, downloads a binary...

Malicious code in ded-pwa-bnpl-forms-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3094b607c6a3b342b1e8a4d7a3acde686d9fba41a68d430e08cda12dd9b0bca On require of the package, index.js loads support.js which executes at import time: it selects a platform-specific output path, downloads a binary...

MAL-2026-12672 Malicious code in ded-aa-liza-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a328f8fbefe24a810c8fe1c0249029992137bec024cab060df03d88347b5185b On require of this package, index.js loads helpers.js which downloads a per-platform native executable linuxx64, linuxarm64, darwin, win32 from...

Malicious code in delivery-ci-microforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffef831e876b8114ebfd6559d38f34d2c559dd42263845899e45ee621aa15c7 On require'delivery-ci-microforms', index.js loads support.js which selects a platform-specific endpoint whose hostname is reassembled at runtime fro...

Malicious code in delivery-ci-sage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b54c7175e494e683cdbc63814267aa5544f88d0373b929b9f0fe3fcb8202bd3 On require of the package, index.js loads loader.js which selects a platform-specific asset path and fetches a binary from one of four...

MAL-2026-12680 Malicious code in delivery-ci-sage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b54c7175e494e683cdbc63814267aa5544f88d0373b929b9f0fe3fcb8202bd3 On require of the package, index.js loads loader.js which selects a platform-specific asset path and fetches a binary from one of four...

Malicious code in delivery-ci-validate-tinkoff-fb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c2b95894675a32af7552c62bb8cd49bbd1d69f64d2685118ed2fede54c0b1a0 The package presents itself as a CI validation helper but index.js calls require'./adapter' on import, causing adapter.js to run automatically...

MAL-2026-12689 Malicious code in delivery-ci-validate-tinkoff-fb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c2b95894675a32af7552c62bb8cd49bbd1d69f64d2685118ed2fede54c0b1a0 The package presents itself as a CI validation helper but index.js calls require'./adapter' on import, causing adapter.js to run automatically...

MAL-2026-12686 Malicious code in delivery-ci-upgrade-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c49d0422f51d7d7937c6a2b133b12ac6f4c6f1b914f03e9a6ad558e1b0f09fce index.js unconditionally requires./runtime at module load. runtime.js detects platform/arch and downloads an OS-specific binary linuxx64, linuxarm64,...

Malicious code in delivery-ci-upgrade-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c49d0422f51d7d7937c6a2b133b12ac6f4c6f1b914f03e9a6ad558e1b0f09fce index.js unconditionally requires./runtime at module load. runtime.js detects platform/arch and downloads an OS-specific binary linuxx64, linuxarm64,...

MAL-2026-12685 Malicious code in delivery-ci-update-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7aaa115c4d227fa01dd5a8b2e9f6945b21c65a7df4433ecf527ef69b3d0b40 On require, index.js loads adapter.js which fetches an unsigned, unhashed platform-specific executable from hardcoded Cloudflare Workers subdomains...

Malicious code in delivery-ci-update-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7aaa115c4d227fa01dd5a8b2e9f6945b21c65a7df4433ecf527ef69b3d0b40 On require, index.js loads adapter.js which fetches an unsigned, unhashed platform-specific executable from hardcoded Cloudflare Workers subdomains...

Malicious code in devplatform-api-v2-resource-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde262833260cbba75c5fdd2160e0f91a6c43c0f7ad202b44475c649772c1174 [email protected] is an import-time dropper. The package's main entry index.js requires compat.js, which on load assembles C2...

MAL-2026-12695 Malicious code in devplatform-api-v2-resource-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde262833260cbba75c5fdd2160e0f91a6c43c0f7ad202b44475c649772c1174 [email protected] is an import-time dropper. The package's main entry index.js requires compat.js, which on load assembles C2...

MAL-2026-12691 Malicious code in devplatform-api-clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e548a0e6be161acd612b2729edd26e431f1bc4405e625daf957ede88db94e017 index.js unconditionally requires./setup.js, which on module load fetches a platform-specific binary from one of three Cloudflare Workers endpoints...

Malicious code in devplatform-auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b5d92af4e479fded008aa25786634ef3869a37c3624f612a320d308808a0626 Requiring devplatform-auth-client loads bootstrap.js, which selects a platform-specific payload URL, downloads opaque bytes over HTTPS from hardcoded...

Malicious code in devplatform-cli-plugin-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e369efa925874a9e8d5b883567522eb39e0284122294d62a92358b0b937f256f On require of the package, index.js loads bootstrap.js, which reconstructs a list of Cloudflare Workers hostnames from split string fragments...

MAL-2026-12701 Malicious code in devplatform-cli-plugin-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e369efa925874a9e8d5b883567522eb39e0284122294d62a92358b0b937f256f On require of the package, index.js loads bootstrap.js, which reconstructs a list of Cloudflare Workers hostnames from split string fragments...