MAL-2026-12868 Malicious code in bnpl-blocks-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd082c1e27c32145bec8b47cf81fa12cde384fd542629dd340c514d71728f8 On require, index.js loads ext.js which assembles Cloudflare Workers hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

MAL-2026-12877 Malicious code in bnpl-blocks-atom-bnpl-image-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893348e540e6c6a6cb856324bb2379d838bead9f4d2ceab1ae7c3509094871f6 On require of the package, index.js loads compat.js, which reconstructs C2 hostnames from string-split arrays e.g.,...

Malicious code in bnpl-blocks-atom-bnpl-image-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893348e540e6c6a6cb856324bb2379d838bead9f4d2ceab1ae7c3509094871f6 On require of the package, index.js loads compat.js, which reconstructs C2 hostnames from string-split arrays e.g.,...

Malicious code in bnpl-blocks-atom-bnpl-base-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7ff15e65896892e348d28080e20d974d32a0f8cd2bb5b523e63b9b3d35395e3 On require of the package, index.js loads polyfill.js, which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev,...

MAL-2026-12865 Malicious code in bnpl-blocks-atom-bnpl-base-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7ff15e65896892e348d28080e20d974d32a0f8cd2bb5b523e63b9b3d35395e3 On require of the package, index.js loads polyfill.js, which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev,...

Malicious code in bnpl-blocks-atom-bnpl-news-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcaf0c737c210018a282e73bbd1570e041a0c70f1043dcdd614e93ac64d8dd68 On require of this package, helpers.js selects a platform-specific URL, fetches an opaque binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12882 Malicious code in bnpl-blocks-atom-bnpl-news-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcaf0c737c210018a282e73bbd1570e041a0c70f1043dcdd614e93ac64d8dd68 On require of this package, helpers.js selects a platform-specific URL, fetches an opaque binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12889 Malicious code in bnpl-blocks-atom-bnpl-range (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d1d5c6a3a1bb7d8a26a77aada7abbec439922ebceec32b8608909ad2ee8acac On require of index.js, shim.js executes immediately and fetches an opaque binary from one of three string-concatenation-obfuscated origins...

Malicious code in bnpl-blocks-atom-bnpl-range (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d1d5c6a3a1bb7d8a26a77aada7abbec439922ebceec32b8608909ad2ee8acac On require of index.js, shim.js executes immediately and fetches an opaque binary from one of three string-concatenation-obfuscated origins...

MAL-2026-12879 Malicious code in bnpl-blocks-atom-bnpl-integrations-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2708bb1921034553386778769eccfeb8858cc65d8890b438cb7dc07bfb1eb60 On require, the package's main entry loads ext.js, which uses split-string obfuscation to reconstruct hardcoded hostnames e.g...

Malicious code in bnpl-blocks-atom-bnpl-integrations-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2708bb1921034553386778769eccfeb8858cc65d8890b438cb7dc07bfb1eb60 On require, the package's main entry loads ext.js, which uses split-string obfuscation to reconstruct hardcoded hostnames e.g...

Malicious code in bnpl-blocks-atom-bnpl-no-index-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02bfd5111a000f3f369e2f973d3717b22e1718fb2edbc4b38a07b67aa395815b On require of the package, index.js loads bootstrap.js which detects OS and architecture, then fetches an OS-specific binary from...

MAL-2026-12883 Malicious code in bnpl-blocks-atom-bnpl-no-index-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02bfd5111a000f3f369e2f973d3717b22e1718fb2edbc4b38a07b67aa395815b On require of the package, index.js loads bootstrap.js which detects OS and architecture, then fetches an OS-specific binary from...

MAL-2026-12887 Malicious code in bnpl-blocks-atom-bnpl-promocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e8267458027ff6475a9d2274d663d26e3869a3646dd35ef5d4bd547f79cde6 On require of the package's main entry, helpers.js runs a bootstrap routine that downloads an OS-specific binary from Cloudflare Workers hosts...

Malicious code in bnpl-blocks-atom-bnpl-promocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e8267458027ff6475a9d2274d663d26e3869a3646dd35ef5d4bd547f79cde6 On require of the package's main entry, helpers.js runs a bootstrap routine that downloads an OS-specific binary from Cloudflare Workers hosts...

Malicious code in bnpl-blocks-atom-bnpl-radio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73e47adf2b698665ad917ed4a512279a35c56dc9683950843d18f207d91767e2 Requiring this package loads polyfill.js, whose top-level initialization downloads a platform-specific binary from runtime-reassembled hosts...

MAL-2026-12878 Malicious code in bnpl-blocks-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 369c74be811d895a5e989cf7723e1ec64e4a40862dcd431da1096953bc362cb4 On require of index.js, the package auto-loads platform.js which reconstructs destination hostnames from split-string fragments e.g...

Malicious code in bnpl-blocks-atom-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d0716eec6e29280316b67f3e9a98954f501dc73a692d36b68d8106b39bd60fb On require of this package, index.js loads shim.js which assembles obfuscated non-publisher URLs by joining split string fragments resolving to a...

MAL-2026-12885 Malicious code in bnpl-blocks-atom-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d0716eec6e29280316b67f3e9a98954f501dc73a692d36b68d8106b39bd60fb On require of this package, index.js loads shim.js which assembles obfuscated non-publisher URLs by joining split string fragments resolving to a...

Malicious code in bnpl-blocks-atom-bnpl-link-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be43998de08cea356c696d856d5469ab529293a1899f1beed856d529200413d On require of the package, index.js loads polyfill.js which selects a platform-specific path, downloads an opaque binary over HTTPS from hardcoded...