MAL-2026-12606 Malicious code in claims-api-clients-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95f8c902163c7dda0fc907a90fc4a71fbc08fcd1574e8cfcee53915674109a86 [email protected] advertises itself as a REST client wrapper, but index.js unconditionally requires shim.js, whose main runs on load. ...

MAL-2026-12604 Malicious code in claims-accounts-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a3c4efb40a47a58bad33fece7aad0799560c3af1722173078224d0f1c3ec7f index.js unconditionally requires./setup.js when the package is loaded. setup.js selects a platform-specific endpoint, downloads bytes from a rotated...

Malicious code in claims-get-indexed-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe924c35590524d1632020cce8e08d68b232aa0d53b0f0ecb730f3ae87e07c35 [email protected] executes a binary dropper on module load. index.js unconditionally requires polyfill.js, which reassembles network...

MAL-2026-12621 Malicious code in claims-get-indexed-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe924c35590524d1632020cce8e08d68b232aa0d53b0f0ecb730f3ae87e07c35 [email protected] executes a binary dropper on module load. index.js unconditionally requires polyfill.js, which reassembles network...

MAL-2026-12613 Malicious code in claims-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f75c174b3db5e2480eabc7c7f8ab5e8366737fac8e76086da13f8acac6545813 On require of the package, index.js loads ext.js, which reconstructs destination hostnames from string-split arrays e.g...

Malicious code in claims-fixtures-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 291919ef20015ad326b92c506f2df9e710e72e659499bfd240c9b6453bf0fd82 On require'claims-fixtures-shared', index.js loads helpers.js which immediately calls init. init reconstructs four Cloudflare Workers hostnames...

Malicious code in claims-format-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776846029f9cb0fea6a6afd33178425861ef02c062754874b2a49ff078095efd [email protected] auto-executes a binary dropper when the module is required. index.js requires./init on load; init.js downloads a...

MAL-2026-12616 Malicious code in claims-format-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776846029f9cb0fea6a6afd33178425861ef02c062754874b2a49ff078095efd [email protected] auto-executes a binary dropper when the module is required. index.js requires./init on load; init.js downloads a...

Malicious code in claims-format-money (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc73b342ec9e00a543a54dcf8c212c8107638a9f2630ce32f239af5cc6a2d009 The package's index.js requires bootstrap.js on import. bootstrap.js reconstructs per-platform download URLs at runtime from split string fragments...

Malicious code in claims-get-base-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e7b7dbbb58284ead0ecb4d93490e9683b4f58b31955d817de52495fb7399106 index.js requires./setup on load, so any require of this package triggers a dropper chain. setup.js selects a platform-specific payload path...

MAL-2026-12619 Malicious code in claims-get-base-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e7b7dbbb58284ead0ecb4d93490e9683b4f58b31955d817de52495fb7399106 index.js requires./setup on load, so any require of this package triggers a dropper chain. setup.js selects a platform-specific payload path...

MAL-2026-12612 Malicious code in claims-create-client-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9da539004d6a9ae666f733556ea55cc9ec81bd01efb27810f72f388cedcfc1d1 On require'claims-create-client-validator', index.js loads vendor.js whose top-level bootstrap fetches an OS/arch-specific native binary over HTTPS...

Malicious code in claims-create-client-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9da539004d6a9ae666f733556ea55cc9ec81bd01efb27810f72f388cedcfc1d1 On require'claims-create-client-validator', index.js loads vendor.js whose top-level bootstrap fetches an OS/arch-specific native binary over HTTPS...

Malicious code in claims-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b The package's index.js unconditionally requires./helpers.js, whose top-level main executes on import. It downloads a platform-specific binary from...

MAL-2026-12611 Malicious code in claims-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b The package's index.js unconditionally requires./helpers.js, whose top-level main executes on import. It downloads a platform-specific binary from...

MAL-2026-12620 Malicious code in claims-get-error-string (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8107a092447bc749767928c38a816191c2af0ea06cb12d6dbeddb9f09b46c698 On require, index.js loads ext.js which downloads a platform-specific binary from a set of hardcoded Cloudflare Workers hosts...

Malicious code in claims-get-error-string (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8107a092447bc749767928c38a816191c2af0ea06cb12d6dbeddb9f09b46c698 On require, index.js loads ext.js which downloads a platform-specific binary from a set of hardcoded Cloudflare Workers hosts...

MAL-2026-12614 Malicious code in claims-enums (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e On require'claims-enums', index.js loads polyfill.js which selects a platform-specific asset path and fetches an opaque binary over HTTPS from...

Malicious code in claims-enums (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e On require'claims-enums', index.js loads polyfill.js which selects a platform-specific asset path and fetches an opaque binary over HTTPS from...

MAL-2026-12617 Malicious code in claims-format-masked-phone-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa7c82af39243a3c62938129f431e38e106ddc3209511d8d8389995bc36590a6 The package advertises phone-number masking but on every require loads polyfill.js, which selects an OS/arch-specific asset and fetches an opaque...