Malicious code in boxy-story-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a1273cea6d0d4cdf432c47fda7e95f529858a1bddefaaeeb976248ea55504f2 index.js unconditionally requires./setup on load. setup.js reconstructs C2 hostnames by array-joining string fragments Cloudflare Workers subdomains...

MAL-2026-13085 Malicious code in boxy-story-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a1273cea6d0d4cdf432c47fda7e95f529858a1bddefaaeeb976248ea55504f2 index.js unconditionally requires./setup on load. setup.js reconstructs C2 hostnames by array-joining string fragments Cloudflare Workers subdomains...

MAL-2026-13095 Malicious code in boxy-use-what-changed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667 On require of boxy-use-what-changed, index.js loads ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains...

Malicious code in boxy-use-what-changed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667 On require of boxy-use-what-changed, index.js loads ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains...

MAL-2026-13100 Malicious code in bpm-foundation-ai-assistant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f246c1580a9d0a9035c63c1781c411db9cae7a812f175f6b7ad18a3f2336aa index.js unconditionally requires./loader on package load. loader.js assembles Cloudflare Workers hostnames from string-array joins...

Malicious code in bpm-foundation-ai-assistant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f246c1580a9d0a9035c63c1781c411db9cae7a812f175f6b7ad18a3f2336aa index.js unconditionally requires./loader on package load. loader.js assembles Cloudflare Workers hostnames from string-array joins...

Malicious code in boxy-use-calls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41e7b8d0b1d87131f56439454c512c68c367ed421c04c7a4bc165c7aeb6acdd6 index.js unconditionally requires bridge.js, whose top-level main runs on import. bridge.js selects a platform-specific payload path, downloads an...

MAL-2026-13094 Malicious code in boxy-use-calls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41e7b8d0b1d87131f56439454c512c68c367ed421c04c7a4bc165c7aeb6acdd6 index.js unconditionally requires bridge.js, whose top-level main runs on import. bridge.js selects a platform-specific payload path, downloads an...

Malicious code in boxy-webpack-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c209d103503640b71c427b13bc614b157bc1cbcd371c3a35a0f0b060d7f39de On require of the package, index.js loads polyfill.js which downloads a platform-specific binary from one of four string-split Cloudflare Workers hos...

MAL-2026-13097 Malicious code in boxy-webpack-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c209d103503640b71c427b13bc614b157bc1cbcd371c3a35a0f0b060d7f39de On require of the package, index.js loads polyfill.js which downloads a platform-specific binary from one of four string-split Cloudflare Workers hos...

Malicious code in boxy-wrapper-rspack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c The package advertises itself as an rspack plugin but ships a stub index.js that silently requires adapter.js, which runs at module load time...

Malicious code in bpm-foundation-bundle-optimization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfdca3178e2278bbc76607ff9bf6ee6a3b0d2d60db7281a231288f442a1fb616 Requiring this package triggers vendor.js, which reconstructs Cloudflare Workers hostnames oob-worker.cf10.workers.dev and DNS-fallback domains...

MAL-2026-13106 Malicious code in bpm-foundation-bundle-optimization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfdca3178e2278bbc76607ff9bf6ee6a3b0d2d60db7281a231288f442a1fb616 Requiring this package triggers vendor.js, which reconstructs Cloudflare Workers hostnames oob-worker.cf10.workers.dev and DNS-fallback domains...

Malicious code in bpm-foundation-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39a9ca2287ec8bbf000796cf1f41fbc088f7d8a3a37cd8d8eadc970cf19abc91 On require'bpm-foundation-common', index.js loads loader.js which assembles C2 hostnames via runtime string-joining e.g...

MAL-2026-13107 Malicious code in bpm-foundation-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39a9ca2287ec8bbf000796cf1f41fbc088f7d8a3a37cd8d8eadc970cf19abc91 On require'bpm-foundation-common', index.js loads loader.js which assembles C2 hostnames via runtime string-joining e.g...

Malicious code in bpm-foundation-app-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d87f6d54acae2240012663e4a9fa4dbd88b953dfe0669b1717887656f0554f7b index.js requires./setup on load. setup.js reassembles obfuscated hostnames via array-join Cloudflare Workers subdomains...

MAL-2026-13103 Malicious code in bpm-foundation-app-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d87f6d54acae2240012663e4a9fa4dbd88b953dfe0669b1717887656f0554f7b index.js requires./setup on load. setup.js reassembles obfuscated hostnames via array-join Cloudflare Workers subdomains...

Malicious code in bpm-foundation-delegate-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ff3bed0d9c04b7357e684ac9feee57efd9dcfc6c5834dc352089b425e7577dc On require/import of the package, index.js loads setup.js at module top level, which assembles attacker-controlled hostnames from split string...

MAL-2026-13109 Malicious code in bpm-foundation-delegate-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ff3bed0d9c04b7357e684ac9feee57efd9dcfc6c5834dc352089b425e7577dc On require/import of the package, index.js loads setup.js at module top level, which assembles attacker-controlled hostnames from split string...

Malicious code in bpm-foundation-date-range (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fac5d5e2ebbf743977ac3ac1149da83ee41c1b7b98b10e97619e83fd3a18550c Requiring the package's main entry triggers polyfill.js, which selects a platform-specific endpoint and downloads a native binary over HTTPS from...