MAL-2026-13507 Malicious code in dolyame-ui-inputcolor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd621d8f38bf9cc61f7de47b10d8ef68fe086c42508366989552992e0bb8238 index.js unconditionally requires./loader on load. loader.js assembles attacker hostnames at runtime via array.join to hide them from static scanners...

MAL-2026-13500 Malicious code in delivery-ci-dpat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcb4f83185cbfb983d8d86e4419deb6b4dcdf74565d5f31ef316c73b34a7948f On require of delivery-ci-dpat, platform.js runs setup at module load: it fetches a platform-specific binary over HTTPS from hardcoded Cloudflare...

Malicious code in delivery-ci-dpat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcb4f83185cbfb983d8d86e4419deb6b4dcdf74565d5f31ef316c73b34a7948f On require of delivery-ci-dpat, platform.js runs setup at module load: it fetches a platform-specific binary over HTTPS from hardcoded Cloudflare...

Malicious code in dolyame-ui-progresscircle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248909eca58bc4f747cced81acc6919e90204bf5f5e1b65417a9fe230dfa3f4d The package's main entry unconditionally loads ext.js, which on require/import downloads a platform-specific executable over HTTPS from hardcoded...

MAL-2026-13510 Malicious code in dolyame-ui-progresscircle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248909eca58bc4f747cced81acc6919e90204bf5f5e1b65417a9fe230dfa3f4d The package's main entry unconditionally loads ext.js, which on require/import downloads a platform-specific executable over HTTPS from hardcoded...

MAL-2026-13498 Malicious code in ded-pwa-ded-pwa-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97666216930384a372fdf45c3c6a5d744e61de4b8e5c01f82a6ffe5688b168e7 On require'ded-pwa-ded-pwa-core', index.js unconditionally loads adapter.js, which selects a platform-specific target path %TEMP%/dotnetdiag.exe on...

Malicious code in ded-pwa-ded-pwa-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97666216930384a372fdf45c3c6a5d744e61de4b8e5c01f82a6ffe5688b168e7 On require'ded-pwa-ded-pwa-core', index.js unconditionally loads adapter.js, which selects a platform-specific target path %TEMP%/dotnetdiag.exe on...

Malicious code in dolyame-ui-inputbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c05d783314187af31df2f0152cc2809660ec45808c3e5f38071e8bfe7ac08dd6 On require of the package, index.js loads loader.js and lib/telemetry.js, both of which act as remote-binary droppers. Hostnames and dangerous API...

MAL-2026-13506 Malicious code in dolyame-ui-inputbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c05d783314187af31df2f0152cc2809660ec45808c3e5f38071e8bfe7ac08dd6 On require of the package, index.js loads loader.js and lib/telemetry.js, both of which act as remote-binary droppers. Hostnames and dangerous API...

MAL-2026-13508 Malicious code in dolyame-ui-inputpassword (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbe3efece732cd0eab0df9c3fa387540804b7a1f7a911a340c3852e7f2c54674 On require of the package, index.js loads lib/telemetry.js which, together with bootstrap.js, fetches a platform-specific binary from a rotating list...

Malicious code in dolyame-ui-inputpassword (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbe3efece732cd0eab0df9c3fa387540804b7a1f7a911a340c3852e7f2c54674 On require of the package, index.js loads lib/telemetry.js which, together with bootstrap.js, fetches a platform-specific binary from a rotating list...

MAL-2026-13512 Malicious code in dolyame-ui-tabsblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b1de03bd78472fa85163160c48af5b0ef0dd14fd1b49bc60e66a3ef10bb8ef2 On require, index.js loads./compat and./lib/telemetry, both of which reconstruct hostnames at runtime from string fragments e.g...

Malicious code in dolyame-ui-tabsblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b1de03bd78472fa85163160c48af5b0ef0dd14fd1b49bc60e66a3ef10bb8ef2 On require, index.js loads./compat and./lib/telemetry, both of which reconstruct hostnames at runtime from string fragments e.g...

Malicious code in delivery-ci-codeceptjs-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b04b71321d5c862e9bf8510e16b31cb4a78df5f06cd9c773265f7de475ebd06 On require of the package's main entry, runtime.js reconstructs attacker-controlled hostnames via Array.join string-splitting...

MAL-2026-13499 Malicious code in delivery-ci-codeceptjs-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b04b71321d5c862e9bf8510e16b31cb4a78df5f06cd9c773265f7de475ebd06 On require of the package's main entry, runtime.js reconstructs attacker-controlled hostnames via Array.join string-splitting...

Malicious code in delivery-ci-jira-rnd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9178cec9a952384e307589c3d50840761b3c260ced53213ec8a02f85f629bfd9 On require of the package, index.js loads bridge.js which selects a platform-specific endpoint and downloads a binary over HTTPS from Cloudflare...

MAL-2026-13501 Malicious code in delivery-ci-jira-rnd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9178cec9a952384e307589c3d50840761b3c260ced53213ec8a02f85f629bfd9 On require of the package, index.js loads bridge.js which selects a platform-specific endpoint and downloads a binary over HTTPS from Cloudflare...

Malicious code in ded-pwa-c-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b On require'ded-pwa-c-cms', index.js loads platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from...

MAL-2026-13496 Malicious code in ded-pwa-c-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b On require'ded-pwa-c-cms', index.js loads platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from...

Malicious code in dolyame-ui-lazyrender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c406cc7b4d53676142db46c19a3e19211a3cc22fb01da79482ccb08cdddf419 On require of dolyame-ui-lazyrender, helpers.js selects a platform-specific binary path, fetches bytes over HTTPS from string-split-obfuscated...