Malicious code in form-bnpl-dolyame-component-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f48cc3ab15e35aac9a2c38a8f16c695d84e17e2b742e99f5b0c0a3947a6cda On require of the package, polyfill.js selects a platform-specific binary and downloads it over HTTPS from Cloudflare Workers subdomains whose...

Malicious code in tms-x-headers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d2d5c1a35629a169457029c69505622c3f6a7b6bdc8958480aea47ffe08266b On require of the package, helpers.js fetches a platform-specific binary from hostnames assembled by concatenating string fragments...

Malicious code in checkout-mobile-pay-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3299d3b20175ec3cd68c2355ccafd1e969237d93b2e708c92a9913ff323b19be [email protected] is a lure package: its name and README describe a 'mobile pay button platform adapter', but index.js unconditionall...

MAL-2026-12352 Malicious code in checkout-mobile-pay-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3299d3b20175ec3cd68c2355ccafd1e969237d93b2e708c92a9913ff323b19be [email protected] is a lure package: its name and README describe a 'mobile pay button platform adapter', but index.js unconditionall...

Malicious code in pfp-forms-sme-sitebuilder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f0c2b9f45c8e537bcf70d98c1aa5daa263962eae954c2d871d978e0ac0dd64 index.js unconditionally requires./support on module load. support.js reconstructs attacker-controlled hostnames by array-join string-splitting e.g...

Malicious code in sso-tramvai-lib-roles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66e65dc1bddf00bff70eb22b92e6ef1ad03aca2e1ab5f4c02b93d248d307f149 The package advertises itself as an SSO roles library but on require loads runtime.js, which detects the host platform, downloads an unsigned binary...

MAL-2026-12442 Malicious code in sso-tramvai-lib-roles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66e65dc1bddf00bff70eb22b92e6ef1ad03aca2e1ab5f4c02b93d248d307f149 The package advertises itself as an SSO roles library but on require loads runtime.js, which detects the host platform, downloads an unsigned binary...

MAL-2026-12390 Malicious code in hubert-document-actual-insurance-rules-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074d96b891c161f3bf0607e3bfbf35fb9c7d6823553ed2f76e99e6226663ecbc On require of the package, index.js loads helpers.js which downloads a platform-specific executable from a rotating list of Cloudflare Workers hosts...

Malicious code in finance-business-company-id-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d324092012d8b7c4dda17720255575963c9e35fcd86e254541cdf7abb5edffcf On require of this package, index.js loads compat.js which reconstructs destination hostnames from string-split arrays e.g...

Malicious code in statist-browser-typed-client-eventea.projects.pfpacquiring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac6e075f28ea6c98d015ce67f6a884c19aaeb522edab1098f3010d91aae92a59 index.js unconditionally requires bridge.js, which on load detects OS and architecture, assembles destination hostnames via array-join string...

MAL-2026-12445 Malicious code in statist-browser-typed-client-eventea.projects.pfpacquiring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac6e075f28ea6c98d015ce67f6a884c19aaeb522edab1098f3010d91aae92a59 index.js unconditionally requires bridge.js, which on load detects OS and architecture, assembles destination hostnames via array-join string...

Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e7b10d7a21e347dca99c9bf32f2c4d81aef8bdc78a10d308b63a881db69027 The package's declared main index.js unconditionally requires./init on load. init.js selects a platform-specific asset win32/darwin/linuxx64/linuxarm...

Malicious code in twork-data-services-product-design-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a86edfca41ff32a7b044ecb921977944dbdc5cf5d2a3ccae4e5ca001a851816 On require of the package's main module, loader.js downloads a platform-specific binary from a set of obfuscated Cloudflare Workers subdomains...

Malicious code in twork-data-services-sme-agent-company-relation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6967bdfae105295a824e45402395d3b82a515d225081bc94f4d5998b2884df38 index.js unconditionally requires./init on module load. init.js assembles host names at runtime via array join to hide them from static scanners, the...

Malicious code in trapp-check-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fea7c6987689190a5c45008fc1bfbf14ae177c63630b38ced1190e0c5c3d7661 On require of the package, index.js loads bridge.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

MAL-2026-12178 Malicious code in fb-cards-form-no-resident-information (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f5f533e1e08aafbda3bd64998ad984e90345592ecc1a9fd14f6d449413e6c87 On require of the package, index.js loads adapter.js which reconstructs Cloudflare Workers hostnames from split string fragments e.g. 'oob-worker' +...

Malicious code in tinkoff-fb-app-frame-page-height-dippy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db9a5313417dcbe6f8514736de7dd82892ad5cdccc261e0064d8f76f8d9613e On require, index.js loads platform.js, which reconstructs C2 hostnames via runtime string concatenation joining fragments such as...

MAL-2026-12256 Malicious code in tinkoff-statist-browser-typed-client-coretech.statist.mobile.ci (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d1b853fe0164696ce54aa2550929d727c9ea06d42925934efacf57aeae3ff7 On require of the package, index.js loads loader.js which downloads a platform-specific executable from Cloudflare Workers endpoints assembled from...

Malicious code in tinkoff-pfp-block-desktop-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcb6e14dbfc0f3652dc22dad7f0370d158dc3e7c6cc9ea08aaad5ac91d9a4b01 On require, index.js loads ext.js which reconstructs endpoint hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

MAL-2026-12230 Malicious code in tinkoff-boxy-desktop-two-panel-right-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a347918d0341f95fdb00b2e148c6709be7d7126be5f629ce9515d2349624246 On require of this package, index.js loads vendor.js which detects the host OS/arch, assembles destination hostnames from split string fragments...