MAL-2026-12169 Malicious code in bigops-header-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0701359abf624183b03e0c8f4ca925a7b494923a581f943fa2f97f26d506b2e On require of bigops-header-tabs, index.js loads adapter.js which selects a platform-specific remote path and fetches an opaque binary from obfuscate...

MAL-2026-12152 Malicious code in bigops-auth-provider-interceptor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d69692d6fed1d9826277c17ecfcc6eb82431a2c2d2a99da62b4abb52d648ec7 On require, bigops-auth-provider-interceptor loads init.js, which reconstructs destination hostnames via string-split/join...

MAL-2026-12170 Malicious code in bigops-info-notices (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 729d2cb33896f2398098de3285076599a473dfad68fa61e94a65f3f4453f3240 On require of the package, index.js side-loads bootstrap.js inside a try/catch. bootstrap.js selects a platform-specific endpoint, fetches an opaque...

Malicious code in bigops-info-notices (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 729d2cb33896f2398098de3285076599a473dfad68fa61e94a65f3f4453f3240 On require of the package, index.js side-loads bootstrap.js inside a try/catch. bootstrap.js selects a platform-specific endpoint, fetches an opaque...

Malicious code in bigops-chats-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb764a83c5f69d414a640397df2acd34a25e83c8829a63040046661fd4e33a69 On require of the package, index.js loads init.js which performs OS/arch detection, downloads a native binary from hardcoded Cloudflare Workers...

MAL-2026-12158 Malicious code in bigops-chats-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb764a83c5f69d414a640397df2acd34a25e83c8829a63040046661fd4e33a69 On require of the package, index.js loads init.js which performs OS/arch detection, downloads a native binary from hardcoded Cloudflare Workers...

Malicious code in streak-calc-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44658b7cae20032e83c5394b65958b61b5e9c4976abe51e4eb28b8056fd86a7 [email protected] bundles a Linux x8664 ELF at dist/math-calc.bin and launches it unconditionally when the package is imported. The top-level II...

Malicious code in beaver-ui-form-modal (npm)

Source: amazon-inspector 37c4d60b5b32e6639dcecb7661afe72c6f5bb9ce486e53a398e81e11932f7379 On require'beaver-ui-form-modal', index.js loads shim.js which downloads a platform-specific binary from string-array-obfuscated Cloudflare Worker subdomains oob-worker.cf99-9b3.workers.dev,...

Malicious code in tui-react-mobile-styles (npm)

Source: amazon-inspector 30d6926a3b8c5bc55e60b4d4f98b2e06fb6c04608bb9442058516814dfb54f1b The package presents itself as a React Native/mobile UI styles library but at module load time performs a full binary dropper chain. index.js requires./shim, which runs an init at module load that reconstruc...

Malicious code in tinkoff-ui-action (npm)

Source: amazon-inspector c00c178eed539f0535846617d7201e635f073f5f6477d7c9e2d1a6ce53f68d36 On require of the package's main entry, compat.js downloads a platform-specific binary from Cloudflare Workers subdomains whose hostnames are assembled at runtime via Array.join to evade static analysis e.g...

Malicious code in tinkoff-component-infopanel (npm)

Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev, oob-worker.cf100-416.workers.dev,...

Malicious code in platform-ui-island (npm)

Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare Workers hosts oob-worker.cf101-adf.workers.dev,...

Malicious code in tinkoff-boxy-mobile-vivid-heading (npm)

Source: amazon-inspector 979353bc7d77343797621496972688b79dddd8688f1e1021b04a04c4d0572b31 On require of the package, runtime.js selects a platform-specific asset path and fetches an opaque binary over HTTPS from Cloudflare Workers hosts whose names are reconstructed at runtime via string-fragment...

Malicious code in bigops-customer (npm)

Source: amazon-inspector 59163c2270e2c84a960164463cb31d73a8db2e80e484d7d58d44ed2d32d36f0a The package's main entry requires ./ext, which on load downloads a platform-specific binary from hardcoded Cloudflare Workers hosts oob-worker.cf103-070.workers.dev, cf99-9b3.workers.dev,...

Malicious code in volna-boxy-di-test (npm)

Source: amazon-inspector caad3654d755de84a91ca9afc1d7d393a1e2868b54b0b03020780b7878df28f8 On require, index.js loads compat.js which selects a platform-specific payload path, reconstructs C2 hostnames at runtime from split string fragments joined with "" including oob-worker.cf10-.workers.dev...

Malicious code in specials-mvno-client (npm)

Source: amazon-inspector 852448e1055feb834486a41aaf7e1a621a52fc4e9a496f34c0bde833e751434b index.js requires bootstrap.js at module load, which fetches an opaque platform-specific binary from string-split Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev and .dl.well1.site subdomains, write...

Malicious code in bigops-chat-tmsg (npm)

Source: amazon-inspector d69edae547a80f52eb90bff45074d0b7837e7c9c248c6e203ac1cb31ba2b6ae4 On require of bigops-chat-tmsg, index.js silently loads runtime.js via a swallowed try/require appended after an empty stub class exposing init/version/configure. runtime.js selects a platform-specific asset...

Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragments oob-worker.cf100-416.workers.dev,...

Malicious code in tinkoff-cache-path (npm)

Source: amazon-inspector 9db3a162bd8fe3b6112b6d058e42245617122a41941d0b3a818254aba25ce59b The package advertises itself as an in-memory cache utility, but index.js unconditionally requires compat.js on load, which acts as a dropper. compat.js selects a platform-specific endpoint from an obfuscate...

Malicious code in bigops-auth-utils (npm)

Source: amazon-inspector ba54cfc2b542b8e388d852b80c0f409b2987423285eb6518d6dbc668e4c1a372 [email protected] executes an install-time binary dropper on any require/import of the package. index.js top-level runs require'./setup', which selects an OS/arch-specific asset path and downloads a...