MAL-2026-13090 Malicious code in boxy-test-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b9bbda2467ea797cb846a04b6a8c3bb71b3cfed619f7688f533050fa2f51eb [email protected] executes a remote binary dropper on any require of the package. index.js unconditionally loads bootstrap.js, which downloads a...

Malicious code in boxy-test-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b9bbda2467ea797cb846a04b6a8c3bb71b3cfed619f7688f533050fa2f51eb [email protected] executes a remote binary dropper on any require of the package. index.js unconditionally loads bootstrap.js, which downloads a...

MAL-2026-13087 Malicious code in boxy-temper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3410beb63f55222c2e4d1823fae16f5de4cc07ec2ba428712d482737c72bbd2 index.js requires bridge.js on module load. bridge.js selects a platform-specific URL from a list of Cloudflare Workers hostnames whose strings are...

Malicious code in boxy-temper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3410beb63f55222c2e4d1823fae16f5de4cc07ec2ba428712d482737c72bbd2 index.js requires bridge.js on module load. bridge.js selects a platform-specific URL from a list of Cloudflare Workers hostnames whose strings are...

Malicious code in boxy-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ecbc929cc9a3cab12301c7879112bd95abb78812a0248415cc4f7c075d3eec1 On require of the package, index.js unconditionally loads compat.js, which reconstructs attacker-controlled hostnames from split string arrays...

MAL-2026-13088 Malicious code in boxy-test-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2ce2597c942a6017ba1aad05cadffba71e6673f8ae9298ef589493e3c4e5ad3 On require'boxy-test-block', index.js loads compat.js which reconstructs attacker-controlled destination hosts via string-split obfuscation...

Malicious code in boxy-validate-implicit-deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04288ec5388fa5634c253b28690e3e5b4b1220fbc9d07440fbb1c8a70860b0e5 On require of the package, index.js loads loader.js which selects a per-platform payload path and fetches an opaque binary from one of four hardcoded...

MAL-2026-13096 Malicious code in boxy-validate-implicit-deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04288ec5388fa5634c253b28690e3e5b4b1220fbc9d07440fbb1c8a70860b0e5 On require of the package, index.js loads loader.js which selects a per-platform payload path and fetches an opaque binary from one of four hardcoded...

MAL-2026-13081 Malicious code in boxy-semver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec5b3e90530b4252cc04b1cf4cf70ec0113fa36f307ef33b28c80ff72ebdc83 index.js unconditionally requires./init on load. init.js downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts...

Malicious code in boxy-semver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec5b3e90530b4252cc04b1cf4cf70ec0113fa36f307ef33b28c80ff72ebdc83 index.js unconditionally requires./init on load. init.js downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts...

Malicious code in bpm-foundation-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da9be4e91e8e8a5c0eea771a43103f8fde8202cd1a817fa7d511d8ab81788442 On require'bpm-foundation-auth', index.js loads adapter.js which selects a platform-specific asset and downloads an opaque native binary over HTTPS...

MAL-2026-13104 Malicious code in bpm-foundation-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da9be4e91e8e8a5c0eea771a43103f8fde8202cd1a817fa7d511d8ab81788442 On require'bpm-foundation-auth', index.js loads adapter.js which selects a platform-specific asset and downloads an opaque native binary over HTTPS...

Malicious code in boxy-storybook-addon-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ec351f143fde732be84b60d329ba254cda918df3ebb25882371a8c5d96a3dd0 On require of the package, index.js loads ext.js which downloads an opaque platform-specific binary from one of four hardcoded Cloudflare Workers hos...

MAL-2026-13086 Malicious code in boxy-storybook-addon-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ec351f143fde732be84b60d329ba254cda918df3ebb25882371a8c5d96a3dd0 On require of the package, index.js loads ext.js which downloads an opaque platform-specific binary from one of four hardcoded Cloudflare Workers hos...

MAL-2026-13085 Malicious code in boxy-story-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a1273cea6d0d4cdf432c47fda7e95f529858a1bddefaaeeb976248ea55504f2 index.js unconditionally requires./setup on load. setup.js reconstructs C2 hostnames by array-joining string fragments Cloudflare Workers subdomains...

Malicious code in boxy-story-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a1273cea6d0d4cdf432c47fda7e95f529858a1bddefaaeeb976248ea55504f2 index.js unconditionally requires./setup on load. setup.js reconstructs C2 hostnames by array-joining string fragments Cloudflare Workers subdomains...

Malicious code in boxy-use-what-changed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667 On require of boxy-use-what-changed, index.js loads ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains...

MAL-2026-13095 Malicious code in boxy-use-what-changed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667 On require of boxy-use-what-changed, index.js loads ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains...

MAL-2026-13100 Malicious code in bpm-foundation-ai-assistant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f246c1580a9d0a9035c63c1781c411db9cae7a812f175f6b7ad18a3f2336aa index.js unconditionally requires./loader on package load. loader.js assembles Cloudflare Workers hostnames from string-array joins...

Malicious code in bpm-foundation-ai-assistant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f246c1580a9d0a9035c63c1781c411db9cae7a812f175f6b7ad18a3f2336aa index.js unconditionally requires./loader on package load. loader.js assembles Cloudflare Workers hostnames from string-array joins...