Malicious code in devplatform-http-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0232efebd49d07216da6eabd594c614076a3d1b414417d0d1be86d547a9c1adc On require of devplatform-http-client, index.js loads vendor.js which unconditionally invokes init. The routine selects a platform-specific payload...

Malicious code in devplatform-npm-versions-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122 On require of the package, adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-12723 Malicious code in devplatform-nx-gle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c9ada1c90c8e8217f9020f02c530477f38a6fd89338f415c815413498036faf On require of devplatform-nx-gle, index.js side-loads a sibling module bridge.js inside a swallowing try/catch. bridge.js reconstructs hardcoded...

MAL-2026-12726 Malicious code in devplatform-nx-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07 The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires support.js, which fetches and executes an...

Malicious code in devplatform-jscodeshift-transforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37b642060b8d602b0de19c132a792a4979dafc0cb06590dc2f10d14fe0980151 On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts destinations...

MAL-2026-12718 Malicious code in devplatform-jscodeshift-transforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37b642060b8d602b0de19c132a792a4979dafc0cb06590dc2f10d14fe0980151 On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts destinations...

Malicious code in devplatform-integrations-tests-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a69dc1ca445f24f40d0b4b24dc010a7d85c8994c65d215f2c6e5efe5dfac28f On require, bootstrap.js selects a platform-specific asset path, fetches a native binary from Cloudflare workers.dev hosts e.g...

Malicious code in devplatform-nx-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8fa5cc0213b5b28609ba1035cb25dd701d3e8690f25b5a3b4dc37f5139fa740 On require of the package, index.js loads support.js, whose top-level init selects a platform-specific asset, downloads a native binary from one of...

Malicious code in devplatform-jscodeshift-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...

Malicious code in devplatform-nx-stylelint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16573678cf46c8aabbd843cd3bbbbe258474f3768d15ad6f1178921b6ad964bf The package presents itself as an Nx stylelint helper but its main entry requires platform.js, which on load downloads a platform-specific executable...

MAL-2026-12728 Malicious code in devplatform-nx-stylelint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16573678cf46c8aabbd843cd3bbbbe258474f3768d15ad6f1178921b6ad964bf The package presents itself as an Nx stylelint helper but its main entry requires platform.js, which on load downloads a platform-specific executable...

Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

MAL-2026-12742 Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

Malicious code in devplatform-po-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 555faac3cf4078b125af0858613813fb3f3bc780a573ddc5713b23d1046c9c71 On require of the package, platform.js detects OS/arch and downloads an opaque binary from Cloudflare Workers hostnames assembled at runtime from...

MAL-2026-12736 Malicious code in devplatform-react-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e5dd30e287186df59dd24c05aa269894c259f42c8a2a214d513e55c6510474e On require of the package's main entry index.js - init.js, the module reconstructs a set of Cloudflare Workers hostnames from string-split fragments...

MAL-2026-12745 Malicious code in devplatform-rest-resources-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a9f72a6d741b5f055738486ee936f61ff645ed6dfdb0e34e746195da5b0d03 On require of the package, index.js loads bootstrap.js which selects a platform-specific endpoint, fetches an opaque native binary over HTTPS from...

Malicious code in devplatform-select-fields (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25bec256fbaf68018dbca1fad82b3616a04cf8d932b67e30b5164ee74dfc4882 [email protected] executes a binary dropper on any require of the package. index.js loads shim.js, which reconstructs C2 hostnames fro...

MAL-2026-12751 Malicious code in devplatform-select-fields (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25bec256fbaf68018dbca1fad82b3616a04cf8d932b67e30b5164ee74dfc4882 [email protected] executes a binary dropper on any require of the package. index.js loads shim.js, which reconstructs C2 hostnames fro...

Malicious code in devplatform-s3-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 618b016d2ee8f333f47ee78c4ffe29b703a08ab7fca524ee072944394fb1301c On require of the package's main entry, bridge.js assembles Cloudflare Workers hostnames from string fragments via Array.join e.g...

MAL-2026-12747 Malicious code in devplatform-s3-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 618b016d2ee8f333f47ee78c4ffe29b703a08ab7fca524ee072944394fb1301c On require of the package's main entry, bridge.js assembles Cloudflare Workers hostnames from string fragments via Array.join e.g...