Malicious code in @vertexa/prisma-fetch-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af31d3f7a70c62590a05ef03453c16828fa36dd8f3887608cc1f0655bea9b4db Package is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled ' @prisma/fetch-engine', author 'Tim Suchanek ...

Malicious code in bnpl-blocks-atom-bnpl-faq-item (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd2fbb910548df40180cd1e71ae6234dddbd8c60b871933d9012bab9f0742bb The package's main entry index.js requires./ext at module load. ext.js downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-13532 Malicious code in ded-pwa-bnpl-forms-test-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c88783bd76d9572c7374272991386daf62532972933bd87e24294bdb6c83d29e On require of the package, index.js loads helpers.js which downloads a platform-specific binary from attacker-controlled Cloudflare Workers endpoints...

MAL-2026-13546 Malicious code in devplatform-spa-plugin-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d61b9d430e59b37ce3c13873e37c1dd146d468b6a06f462761e2214acd1d0fa [email protected] executes attacker-controlled code on the installer's host at module import. The package's main entry loa...

MAL-2026-13497 Malicious code in ded-pwa-c-page-maker-props (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da On require of the package, compat.js selects a platform-specific endpoint and fetches an opaque binary from string-obfuscated Cloudflare Workers host...

Malicious code in ded-pwa-c-page-maker-props (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da On require of the package, compat.js selects a platform-specific endpoint and fetches an opaque binary from string-obfuscated Cloudflare Workers host...

MAL-2026-13248 Malicious code in bigops-rx-post-message (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1298706de8e41561be6743e6d8349c5feefb81bec1ba71f3f2da3995d845ac98 On require of bigops-rx-post-message, index.js executes init.js at module top level, which downloads a platform-specific binary from Cloudflare Worke...

Malicious code in devplatform-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated...

MAL-2026-13312 Malicious code in dolyame-boxy-independent-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95d52abe2ced4314ede2df4d3475d73fb87f52298434cdbf6469bf057613346f index.js unconditionally requires./init at module load time. init.js selects a platform-specific path, fetches an opaque native binary over HTTPS fro...

MAL-2026-13317 Malicious code in dolyame-boxy-independent-bnpl-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f65bcb53883eb5b3dcd6fe4d8b8ee61e24dad3323aa4ee4431a62b770e17f7a On require, bridge.js downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-independent-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 955003be540a21f5e2fd1a7a5a5586276a5cc7f733c09d1f5412250fe0035f1b On require of the package, index.js loads setup.js, which selects a platform-specific path, fetches an opaque binary from a rotating pool of Cloudfla...

Malicious code in dolyame-boxy-independent-bnpl-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4340fab762980b85544094ef1795fd82968bb58c7fe0f17a00f50b2df89b29d5 On require of the package, index.js loads setup.js, which reconstructs attacker-controlled hostnames by splitting string literals across arrays and...

Malicious code in dolyame-ui-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a445ffd0f222f7d58ad870ad641f9dd2fb21a1cc43795cbef5c58109cafebbe On require of the package, index.js loads vendor.js, which reconstructs a set of C2 hostnames from string-split fragments four .workers.dev mirrors a...

MAL-2026-13178 Malicious code in dolyame-ui-react-dom-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c3f53ba29324123e792649baa012f91a2a980590dea560599490d8020b6274b On require of the package's main entry, helpers.js selects a platform-specific target path, fetches an opaque binary over HTTPS from author-controlle...

MAL-2026-13195 Malicious code in dolyame-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c23ba8923130746ecc1e526c3a0ee8961ea764dd90d0da71236444d978ce27 dolyame-ui-themes ships a loader.js that is required from the package main index.js at module load. The loader reconstructs C2 hostnames from split...

Malicious code in beaver-ui-side-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868e87654c2af06a8362918fbcd52680c253a85063f1a0c7fc71494b0cfd304d On require/import of the package, index.js unconditionally loads helpers.js which fetches a platform-specific binary from attacker-controlled...

MAL-2026-12823 Malicious code in beaver-ui-side-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868e87654c2af06a8362918fbcd52680c253a85063f1a0c7fc71494b0cfd304d On require/import of the package, index.js unconditionally loads helpers.js which fetches a platform-specific binary from attacker-controlled...

Malicious code in bnpl-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eda2ee8ac0f1ffdce814e7ca4bb7e1c1ca52beebb7048b18a64d8e13e87abf4 The package presents itself as an empty API stub index.js exports a no-op BnplApi and unconditionally require"./support" on load. support.js assemble...

MAL-2026-12860 Malicious code in bnpl-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eda2ee8ac0f1ffdce814e7ca4bb7e1c1ca52beebb7048b18a64d8e13e87abf4 The package presents itself as an empty API stub index.js exports a no-op BnplApi and unconditionally require"./support" on load. support.js assemble...

Malicious code in bnpl-blocks-atom-bnpl-small-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c774d6998dfe3f37ec23c527ddb5dee44c7448c88d5f059905ed3b6ef04959c index.js unconditionally requires helpers.js on module load. helpers.js reconstructs mirror hostnames from split string fragments e.g...