MAL-2026-12526 Malicious code in cards-forms-clone-debit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af0f7b9b02ef9fef4376ec3f311e60acabe0881cd5ef1ffa503571bdce2158a4 On require, index.js loads bootstrap.js which reconstructs endpoint hostnames from split string fragments assembling .workers.dev hosts such as...

Malicious code in cards-forms-credit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cf698916c071bb43228f0e40bbb5fc10c2c35c495e091c0b3d1cf1c10e8eb26 On require'cards-forms-credit-clone', index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare workers.dev host...

MAL-2026-12527 Malicious code in cards-forms-credit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cf698916c071bb43228f0e40bbb5fc10c2c35c495e091c0b3d1cf1c10e8eb26 On require'cards-forms-credit-clone', index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare workers.dev host...

MAL-2026-12522 Malicious code in capacity-capacity-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6bca5365f5c34188532641c63143e3fd2306d2c7ffe64a78de98904c43d6b7c On require of the package's main entry, adapter.js downloads a platform-specific binary from one of three string-split-obfuscated Cloudflare Workers...

Malicious code in capacity-capacity-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6bca5365f5c34188532641c63143e3fd2306d2c7ffe64a78de98904c43d6b7c On require of the package's main entry, adapter.js downloads a platform-specific binary from one of three string-split-obfuscated Cloudflare Workers...

MAL-2026-12528 Malicious code in cards-forms-debit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cfb99b5f4ad953f445a050a5cb70c26e477398cedef5406fdce1343887a6e38 On require, index.js loads shim.js which downloads a platform-specific binary from anonymous .workers.dev subdomains hostnames assembled at runtime b...

Malicious code in cards-forms-debit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cfb99b5f4ad953f445a050a5cb70c26e477398cedef5406fdce1343887a6e38 On require, index.js loads shim.js which downloads a platform-specific binary from anonymous .workers.dev subdomains hostnames assembled at runtime b...

MAL-2026-12521 Malicious code in candy-candy-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6eb2dd43ce21b00ec40ac6df2c7eee73a20e090d923e5d08c2fd48c01b82eb5 Requiring candy-candy-core loads index.js which unconditionally requires./polyfill.js. polyfill.js constructs attacker-controlled hostnames by joinin...

Malicious code in candy-candy-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6eb2dd43ce21b00ec40ac6df2c7eee73a20e090d923e5d08c2fd48c01b82eb5 Requiring candy-candy-core loads index.js which unconditionally requires./polyfill.js. polyfill.js constructs attacker-controlled hostnames by joinin...

Malicious code in bs-bs-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f3619c5623fc30ab616c89c04badd56a5f3de98cba7a625b647ce98921a65f6 On require'bs-bs-core', index.js loads compat.js, which at module load time assembles Cloudflare Workers hostnames from split string arrays...

Malicious code in cards-forms-clone-credit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b4f08d76d45a73180470637c59e6f64755dcc8f24853b66140d014b1dcbbdf8 On require of cards-forms-clone-credit-clone, index.js loads helpers.js which auto-invokes a setup routine that detects the host OS/arch, downloads a...

MAL-2026-12525 Malicious code in cards-forms-clone-credit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b4f08d76d45a73180470637c59e6f64755dcc8f24853b66140d014b1dcbbdf8 On require of cards-forms-clone-credit-clone, index.js loads helpers.js which auto-invokes a setup routine that detects the host OS/arch, downloads a...

MAL-2026-12520 Malicious code in caen-caen-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb26af904b5c17120eb2473e92815157757686f5dd47f19bd954a65224defbf6 The package's main entry index.js loads ext.js on require. ext.js downloads an OS-specific native binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12538 Malicious code in certificates-revocation-sw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3037d3d739bf6d25fbb06a613915278de458d3b90547bdbf11b2710b7d88d82a The package's index.js unconditionally loads bootstrap.js, which on require fetches a platform-specific binary from obfuscated Cloudflare Workers hos...

MAL-2026-12539 Malicious code in certificates-revocation-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f10384b425fd13237d69f5a9d71f6c893bd9063b32be2665f8a30f95ddda837 On module load, index.js requires vendor.js which fetches a platform-specific binary from runtime-reconstructed Cloudflare Workers hostnames assemble...

Malicious code in cardsmobile-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd23d89483d10aedc3f1a8717673dbae0608df14a168e5d2287e09afe631af7 On require of the package, index.js loads ext.js which unconditionally downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12533 Malicious code in cardsmobile-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd23d89483d10aedc3f1a8717673dbae0608df14a168e5d2287e09afe631af7 On require of the package, index.js loads ext.js which unconditionally downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12537 Malicious code in cbp-exchange-government-cbp-exchange-government-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e8845f778d906df5e69c06c91840deb7718a94ccacdd371c987b003f6d85bdb index.js unconditionally requires./loader on module load. loader.js assembles three Cloudflare Workers hostnames via split-array .join"" obfuscation...

Malicious code in cbp-exchange-government-cbp-exchange-government-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e8845f778d906df5e69c06c91840deb7718a94ccacdd371c987b003f6d85bdb index.js unconditionally requires./loader on module load. loader.js assembles three Cloudflare Workers hostnames via split-array .join"" obfuscation...

MAL-2026-12536 Malicious code in cardsmobile-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d80bf756b4d7e7f6e27afd68a796dc43ca50d28e692d11b4af141b0af5235b On require, index.js loads shim.js which selects a platform-specific payload URL from a string-split-obfuscated list of Cloudflare Workers subdomains...