Malicious code in bigops-rx-post-message (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1298706de8e41561be6743e6d8349c5feefb81bec1ba71f3f2da3995d845ac98 On require of bigops-rx-post-message, index.js executes init.js at module top level, which downloads a platform-specific binary from Cloudflare Worke...

MAL-2026-13144 Malicious code in dolyame-ui-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a445ffd0f222f7d58ad870ad641f9dd2fb21a1cc43795cbef5c58109cafebbe On require of the package, index.js loads vendor.js, which reconstructs a set of C2 hostnames from string-split fragments four .workers.dev mirrors a...

MAL-2026-12872 Malicious code in bnpl-blocks-atom-bnpl-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe2cdda88c39101955d7333e81f68b9cefe2dbfab23862351194168e2c61e5e9 index.js unconditionally requires./support at package load. support.js reconstructs a list of Cloudflare Workers hostnames...

MAL-2026-12871 Malicious code in bnpl-blocks-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953d88d16a72d63369a076b864facc257f63385eb38d220ca649b8712ff50277 On require, index.js loads setup.js which selects a platform-specific binary path for linux/darwin/win32, downloads it over HTTPS from hardcoded...

Malicious code in boxy-render-unwrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26755161d9a2ac85d670783fc7eb67383b08592dbb67899b916d3e521d560420 On require of boxy-render-unwrap, index.js loads bootstrap.js which selects a platform-specific payload URL from a set of obfuscated mirror hosts...

MAL-2026-13119 Malicious code in bpm-foundation-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1e2729c7a957ee4366b693a24d178137743df7bf2ee5d65d3cecf3c8cfdc5f On require, index.js loads ext.js, which selects a platform-specific path, fetches an executable over HTTPS from string-concatenation-obfuscated host...

MAL-2026-12515 Malicious code in bpm-foundation-test-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de196f443359e53af966cb2ca288d90e59e708c2cf7ad33ab2e0e20b7df2869e On require, index.js loads setup.js which assembles destination hostnames at runtime from split string fragments resolving to...

MAL-2026-12609 Malicious code in claims-block-visibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6afd966a220b14c0d01a2132af36d206eee200ab806d61443b66379e560b324 On require'claims-block-visibility', index.js loads polyfill.js which unconditionally runs a setup routine that selects an OS-specific endpoint,...

MAL-2026-12604 Malicious code in claims-accounts-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a3c4efb40a47a58bad33fece7aad0799560c3af1722173078224d0f1c3ec7f index.js unconditionally requires./setup.js when the package is loaded. setup.js selects a platform-specific endpoint, downloads bytes from a rotated...

Malicious code in delivery-ci-pipeline-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48367fe7933e3c07d664eda305a21bd8de43e06c685170b2146da16249bde15c index.js unconditionally requires init.js on load. init.js assembles attacker-controlled hostnames from split string fragments joined at runtime e.g...

MAL-2026-12694 Malicious code in devplatform-api-v2-endpoint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f78874e3ff64b85f64b75f0481a7cadc00f15dea7b4f0eb85c1728a65ee2020 On require, index.js loads./vendor, whose top-level init fetches a platform-specific native binary from runtime-assembled Cloudflare Workers hosts...

Malicious code in devplatform-nx-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07 The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires support.js, which fetches and executes an...

MAL-2026-12760 Malicious code in devplatform-spa-plugin-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22202ea28f902a0048608456e99803ff08f06d111ce97813292e2b1d018c06ec [email protected] advertises itself as an analytics library, but on require its main entry loads adapter.js which downloads a...

Malicious code in quorvex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9127b24fd8619b810163b5b5714d580951a3a96cfa1b37e63a57ff3cc9c2cca5 [email protected] ships index.mjs as the package main, containing a base64-encoded Windows PE 355KB in a PAYLOAD constant. At import time on Windows host...

Malicious code in sme-auth-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3d46bc99b3f8904f9d24bfac1600b245fe39af77d713acf1ee761bb57212f3c On require'sme-auth-core', index.js loads init.js which platform-selects a URL and fetches an opaque binary from one of three string-obfuscated...

MAL-2026-12209 Malicious code in statist-browser-typed-client-ddp.mentat.ui.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dc78a545236395c12156cd5f8e36337df53024afd0a6a6da75f81fb9b7c11e7 The package's main entry index.js loads polyfill.js, which on module load detects OS and architecture, fetches a per-platform binary over HTTPS from...

MAL-2026-10523 Malicious code in @tabrex/bs58 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f8a6402182b6dec89b04f15d70fcdd2b78d678947d49c62a3f09b11a70bf306 @tabrex/bs58 ships the verbatim README, API surface, and repository URL of the legitimate cryptocoinjs/bs58 package package.json declares repository...

MAL-2026-10400 Malicious code in @equansservices/tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb693b5ae7f1fccb6c2aaa1a5f9225b23fb7ece3928feca604f2c5139ee5198 The package's postinstall hook node setup.js fetches a platform-specific payload from http://d2vf4rs175cy2k.cloudfront.net/install/v1/plugin.zip over...

Malicious code in @nullzero/urlcat (npm)

@nullzero/urlcat version 1.4.2, published by [email protected] is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accounts all follow the pattern [email protected], with...

Malicious code in proto-bin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1994859460fe293cad87eadf5c704e5c717c71deaaf54842f5e29fce765f99d5 Package is advertised as a prototype utilities library pack/unpack/checksum but its exported pack function calls an internal fetch that downloads a...