MAL-2026-12850 Malicious code in bigops-ui-kit-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2db8a58fec98e1913d3aab98b7f40a0580a16aeea9b7d5af4cf560026b463ac1 On require of bigops-ui-kit-styles, index.js loads compat.js which fetches a platform-specific executable from obfuscated Cloudflare Workers subdomai...

Malicious code in bigops-ui-kit-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2db8a58fec98e1913d3aab98b7f40a0580a16aeea9b7d5af4cf560026b463ac1 On require of bigops-ui-kit-styles, index.js loads compat.js which fetches a platform-specific executable from obfuscated Cloudflare Workers subdomai...

MAL-2026-12851 Malicious code in bigops-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f281ddf755708d180e0d2817df0e23c640fb1ab2d17441c7f35309bb37086bc1 index.js unconditionally requires./vendor at module load. vendor.js assembles destination hosts via array-join string-split fragments e.g...

MAL-2026-12817 Malicious code in beaver-ui-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f257786868c5d56c3f9f79e674980d07bfad3a42194819837623614554abb77 On require'beaver-ui-list', index.js loads ext.js, which selects a payload path based on OS and architecture, downloads a native binary from hardcode...

Malicious code in beaver-ui-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f257786868c5d56c3f9f79e674980d07bfad3a42194819837623614554abb77 On require'beaver-ui-list', index.js loads ext.js, which selects a payload path based on OS and architecture, downloads a native binary from hardcode...

MAL-2026-12864 Malicious code in bnpl-blocks-atom-bnpl-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e57d88037b98733cb7376fa7fa11e80d1d6eb6f9373a7d6e1b555e96039b3abe On require of the package, index.js unconditionally loads polyfill.js, which downloads a platform-specific binary from one of three obfuscated...

Malicious code in beaver-ui-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eaa4db154b26013412a01287354ef2f0ffb074b9bfd27c6e214fd60ddf4c9be The package's main index.js unconditionally requires./setup.js at load time. setup.js selects a platform-specific path, downloads an opaque native...

MAL-2026-12826 Malicious code in beaver-ui-storybook-addon-code-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8105d085fbf1a6ec1018ac850555ec02e022725ce198f54ac291133b847d9db On require of the package main, loader.js selects an OS-specific endpoint, downloads a binary via https.get from one of several hardcoded Cloudflare...

Malicious code in beaver-ui-storybook-addon-code-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8105d085fbf1a6ec1018ac850555ec02e022725ce198f54ac291133b847d9db On require of the package main, loader.js selects an OS-specific endpoint, downloads a binary via https.get from one of several hardcoded Cloudflare...

MAL-2026-12825 Malicious code in beaver-ui-split-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9758e9a6587fb3c1314e69b881d33a634fb0255cf6bdd3540ab74a533aacc1 On require'beaver-ui-split-view', index.js loads bootstrap.js, which selects an OS/arch-specific asset and fetches an opaque binary over HTTPS from...

Malicious code in beaver-ui-split-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9758e9a6587fb3c1314e69b881d33a634fb0255cf6bdd3540ab74a533aacc1 On require'beaver-ui-split-view', index.js loads bootstrap.js, which selects an OS/arch-specific asset and fetches an opaque binary over HTTPS from...

Malicious code in dbk-ui-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36c6972ca0999559f2a4548843790c8000451acb4869da3c83d0357a655586ba On npm install, the package's preinstall hook runs index.js which collects host identity hostname, username, homedir, network interfaces, uid, output...

Malicious code in jquery.ui.tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50fc48e6d03705244cf78a2f2ee23c6ffe5a91a64f98d23d6a31f94557bf0d84 [email protected] is a dependency-confusion squat: it is published at version 9999.0.0 with an empty runtime index.js contains only...

Malicious code in jquery.ui.core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fe5bc94d3ac40b31064d4dad8125dc959fdc3559785cdbeb03de2cc16c147ac Package is a dependency-confusion squat on the jquery.ui.core name published at version 9999.0.0. The main entry index.js is empty module.exports = ;...

MAL-2026-12368 Malicious code in electrode-ota-ui-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498 Package targets the electrode-io internal name electrode-ota-ui-app with an inflated 99.0.1 version to win dependency resolution against a private...

Malicious code in taiga-ui-proprietary-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9be903f19ea37784411ce57029badf1434b3c273eded5c55622980e98b8aa2c Package advertises itself as Taiga UI proprietary navigation components but ships adapter.js, which is required by index.js at module load. On requir...

MAL-2026-12146 Malicious code in beaver-ui-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86ba5710d957735b0f3fde73e6b6ba99347296b8dc992db5f1807924f3ffc139 The package's declared main index.js unconditionally loads ext.js, which on require fetches a platform-specific binary from obfuscated Cloudflare...

Malicious code in beaver-ui-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86ba5710d957735b0f3fde73e6b6ba99347296b8dc992db5f1807924f3ffc139 The package's declared main index.js unconditionally loads ext.js, which on require fetches a platform-specific binary from obfuscated Cloudflare...

Malicious code in beaver-ui-form-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b91edd276d95174766d639bab6981de8e07b4261e57668fc61f8e7dd96cc1e On require of the package, index.js loads polyfill.js whose top-level bootstrap fetches an opaque platform-specific binary over HTTPS from...

MAL-2026-12145 Malicious code in beaver-ui-form-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b91edd276d95174766d639bab6981de8e07b4261e57668fc61f8e7dd96cc1e On require of the package, index.js loads polyfill.js whose top-level bootstrap fetches an opaque platform-specific binary over HTTPS from...