MAL-2026-13073 Malicious code in boxy-mops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d377c600e4c23a91ca7b5c4465804849e0427d7f14392877ad961244142fe477 On require, boxy-mops loads compat.js, which assembles attacker-controlled hostnames from split string fragments resolving to...

Malicious code in boxy-sticky-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc08631cb79f90d5440020f420e9c7ad9e67ec84f25f085825c5b5f600f613a4 On require of the package, init.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at runtime from...

MAL-2026-13076 Malicious code in boxy-pkg-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae99d3d2f9b6c2a5a47e8edd34fb78968ffc58c3a514e04ad10b14455d7436f2 index.js unconditionally loads support.js on require. support.js reconstructs Cloudflare Workers hostnames oob-worker.cf100,1,2-.workers.dev and a.ru...

Malicious code in boxy-test-block-fixture (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b10e5c9aa6fedcb9d29f292cd6f5aa6634e770f46c6385a9fb32c0fc628ab27a On require/import of the package, init.js assembles attacker-controlled hostnames at runtime by joining split string fragments resolving to...

Malicious code in boxy-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfb29953971bb0c3eae94e97f7a9efe132bd4a954252ae52c989f990f389d098 index.js unconditionally requires./setup.js on module load. setup.js assembles Cloudflare Workers hostnames from split-string arrays...

Malicious code in boxy-test-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2ce2597c942a6017ba1aad05cadffba71e6673f8ae9298ef589493e3c4e5ad3 On require'boxy-test-block', index.js loads compat.js which reconstructs attacker-controlled destination hosts via string-split obfuscation...

Malicious code in boxy-validate-implicit-deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04288ec5388fa5634c253b28690e3e5b4b1220fbc9d07440fbb1c8a70860b0e5 On require of the package, index.js loads loader.js which selects a per-platform payload path and fetches an opaque binary from one of four hardcoded...

Malicious code in boxy-tree-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98d9e378c994473ce3e3be434420e616cf1f9f4cf4c71c2b61091a2dffe34ca5 On any require/import of the package, index.js loads ext.js which reconstructs four Cloudflare Workers destinations oob-worker.cf.workers.dev via...

MAL-2026-13093 Malicious code in boxy-tree-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98d9e378c994473ce3e3be434420e616cf1f9f4cf4c71c2b61091a2dffe34ca5 On any require/import of the package, index.js loads ext.js which reconstructs four Cloudflare Workers destinations oob-worker.cf.workers.dev via...

MAL-2026-13105 Malicious code in bpm-foundation-base-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d880fad0158970d8ef9b0a0884fe6b2ceee572d3046db4cf08745d02d3c34293 On require, index.js loads helpers.js, which reconstructs C2 hostnames via string-split-join concatenation...

MAL-2026-13102 Malicious code in bpm-foundation-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5 On require, index.js loads polyfill.js which performs an https.get to hardcoded Cloudflare Workers hostnames assembled by joining string fragments...

Malicious code in bpm-foundation-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5 On require, index.js loads polyfill.js which performs an https.get to hardcoded Cloudflare Workers hostnames assembled by joining string fragments...

Malicious code in boxy-webpack-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c209d103503640b71c427b13bc614b157bc1cbcd371c3a35a0f0b060d7f39de On require of the package, index.js loads polyfill.js which downloads a platform-specific binary from one of four string-split Cloudflare Workers hos...

MAL-2026-13099 Malicious code in boxy-wrapper-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50 The package's main entrypoint index.js unconditionally requires./compat.js, whose top-level main reconstructs obfuscated Cloudflare Workers hosts...

MAL-2026-12517 Malicious code in bpm-renovate-renovate-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b2fc5b92d1c0023e38459ab9285d928b6fbe3124bfda9d4d6b055dd1fe0bf4e On require, index.js loads setup.js which downloads a platform-specific binary over HTTPS from one of four string-concatenation-obfuscated .workers.d...

Malicious code in bpm-renovate-renovate-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b2fc5b92d1c0023e38459ab9285d928b6fbe3124bfda9d4d6b055dd1fe0bf4e On require, index.js loads setup.js which downloads a platform-specific binary over HTTPS from one of four string-concatenation-obfuscated .workers.d...

MAL-2026-12525 Malicious code in cards-forms-clone-credit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b4f08d76d45a73180470637c59e6f64755dcc8f24853b66140d014b1dcbbdf8 On require of cards-forms-clone-credit-clone, index.js loads helpers.js which auto-invokes a setup routine that detects the host OS/arch, downloads a...

Malicious code in caen-caen-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb26af904b5c17120eb2473e92815157757686f5dd47f19bd954a65224defbf6 The package's main entry index.js loads ext.js on require. ext.js downloads an OS-specific native binary from hardcoded Cloudflare Workers hosts...

Malicious code in checkout-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6130d2e85aedac754a5a7f0d31a255c2f45d702484e6a81df50ca4c326395aa On require of the package's main index.js, the hidden polyfill.js runs a bootstrap routine that selects a platform-specific asset path, fetches an...

Malicious code in checkout-base-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2 On require of this package, index.js loads helpers.js which runs at import time. The module assembles three attacker-controlled hostnames from split...