MAL-2026-13288 Malicious code in dolyame-boxy-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfa5d8518650ddd83b31e9587264a2ed049a47db5c8452af6d62eb50e9fa336 On load, index.js requires./loader.js which reconstructs anonymous host names via array-join obfuscation...

Malicious code in devplatform-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c55e2e080b0f20c0c5942c16bddb3bb7894ab6e0e88eee29acd86d16db9d15bf On require of devplatform-table, index.js loads./compat which selects a platform-specific payload path, downloads an executable from...

Malicious code in bnpl-blocks-atom-bnpl-integrations-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2708bb1921034553386778769eccfeb8858cc65d8890b438cb7dc07bfb1eb60 On require, the package's main entry loads ext.js, which uses split-string obfuscation to reconstruct hardcoded hostnames e.g...

Malicious code in devplatform-spa-plugin-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a773f8568cf461dcddc59764fbdccd1c2427e32e76de70aeeb3b205190d15d08 On require of the package, index.js loads./ext.js, which selects a platform-specific endpoint from a runtime-assembled list of Cloudflare Worker...

MAL-2026-12777 Malicious code in devplatform-spa-plugin-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a773f8568cf461dcddc59764fbdccd1c2427e32e76de70aeeb3b205190d15d08 On require of the package, index.js loads./ext.js, which selects a platform-specific endpoint from a runtime-assembled list of Cloudflare Worker...

Malicious code in sme-crm-services-sme-crm-services-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08ec89cd09f6d62ee7e1a0e509712ee53f41f3ebba4139453cf1e3a1080fe3c9 On require of the package, index.js loads vendor.js which selects an OS/architecture-specific URL path, downloads an opaque binary over HTTPS from...

MAL-2026-12292 Malicious code in twork-data-services-getting-arrests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcfe9505e3a40e8cd4c314f982901e6cbc0c988fbe6ae5fef58c6c1dc5b78a33 [email protected] acts as a binary dropper. index.js top-level requires./support.js, whose start runs at load time: it selec...

MAL-2026-12066 Malicious code in hubert-appointment-v2-task-create-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8f56f6191b24e3c2163a226ca0bb2b76f309fb9a7aabb77f8ebc5ddf63bd109 On require, platform.js reconstructs destination hostnames from split-string arrays e.g. 'oob-worker.cf103-070.workers.dev' assembled from...

MAL-2026-12069 Malicious code in nxify-unic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2645ab342655ef98b8905299be8fc515978b43f6cf36ae564c9da827227dd391 On require'nxify-unic', index.js loads shim.js which detects OS/architecture, assembles destination hostnames at runtime by string-splitting and...