Malicious code in devplatform-cli-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bb41284069ba395bf67ceb847dc579c7a79c753ea89107116e91559ebbece2a On require'devplatform-cli-spa', index.js loads support.js which selects a payload by OS and architecture, downloads a native binary over HTTPS from...

MAL-2026-12704 Malicious code in devplatform-cli-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bb41284069ba395bf67ceb847dc579c7a79c753ea89107116e91559ebbece2a On require'devplatform-cli-spa', index.js loads support.js which selects a payload by OS and architecture, downloads a native binary over HTTPS from...

Malicious code in devplatform-cli-plugin-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8460a9cc2fce88e69d25156ea88612a5a67ffba26709ce88900d573e2f4b3ea On require of the package, index.js loads bootstrap.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads an...

MAL-2026-12702 Malicious code in devplatform-cli-plugin-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8460a9cc2fce88e69d25156ea88612a5a67ffba26709ce88900d573e2f4b3ea On require of the package, index.js loads bootstrap.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads an...

Malicious code in devplatform-data-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9d428dae035b88a4c025d9edd346d22cf2dffbb5a21ae597560702280b3949 On require'devplatform-data-table', index.js loads ext.js inside a swallowed try/catch. ext.js reconstructs a rotating list of Cloudflare Workers...

MAL-2026-12708 Malicious code in devplatform-data-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9d428dae035b88a4c025d9edd346d22cf2dffbb5a21ae597560702280b3949 On require'devplatform-data-table', index.js loads ext.js inside a swallowed try/catch. ext.js reconstructs a rotating list of Cloudflare Workers...

Malicious code in devplatform-di (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3fd866e9abd20e9fa0c9ca40131d13b1ca98e2abbe73f53fd063581a65256d9 On require'devplatform-di', index.js loads compat.js which fetches a platform-specific executable from string-split-obfuscated hosts...

MAL-2026-12712 Malicious code in devplatform-http-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0232efebd49d07216da6eabd594c614076a3d1b414417d0d1be86d547a9c1adc On require of devplatform-http-client, index.js loads vendor.js which unconditionally invokes init. The routine selects a platform-specific payload...

Malicious code in devplatform-http-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0232efebd49d07216da6eabd594c614076a3d1b414417d0d1be86d547a9c1adc On require of devplatform-http-client, index.js loads vendor.js which unconditionally invokes init. The routine selects a platform-specific payload...

MAL-2026-12701 Malicious code in devplatform-cli-plugin-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e369efa925874a9e8d5b883567522eb39e0284122294d62a92358b0b937f256f On require of the package, index.js loads bootstrap.js, which reconstructs a list of Cloudflare Workers hostnames from split string fragments...

Malicious code in devplatform-eslint-plugin-nx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35adb61664d8a7067c4ace2c143ed75e5e316dcd5365201ac8614ef9ff07e668 [email protected] is a typosquat lure targeting @nx/eslint-plugin. On require of the package, index.js loads runtime.js which...

Malicious code in devplatform-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9eab2b5f60c30ade507d29f76ffef745c0c12719aefb9f289d57f335288aeac4 [email protected] advertises itself as a markdown provider but on require of index.js loads adapter.js, which fetches a platform-specific...

Malicious code in devplatform-nx-pvm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58df39bb6ab40bc06f0c7db6a10753e81979cae9692633b51a33089ff6d28aa4 On require of devplatform-nx-pvm, compat.js fetches a platform-specific binary over HTTPS from hardcoded hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-12725 Malicious code in devplatform-nx-pvm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58df39bb6ab40bc06f0c7db6a10753e81979cae9692633b51a33089ff6d28aa4 On require of devplatform-nx-pvm, compat.js fetches a platform-specific binary over HTTPS from hardcoded hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-npm-versions-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122 On require of the package, adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-12721 Malicious code in devplatform-npm-versions-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122 On require of the package, adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-nx-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07 The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires support.js, which fetches and executes an...

Malicious code in devplatform-iam-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494d7de346ffd38cb213791a60c0a1e19d6391e79643e052d31c8ac1e8028b3f The package presents a no-op DevplatformIamClient export, but index.js unconditionally requires./init.js on load. init.js selects a platform-specific...

Malicious code in devplatform-jscodeshift-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92dcd946aaaf9b57795f9a94877df34a69ac39828620c58e2cf4b72cd7a9c253 On require, index.js loads loader.js, which reconstructs Cloudflare Workers hostnames from split string fragments e.g...

MAL-2026-12717 Malicious code in devplatform-jscodeshift-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92dcd946aaaf9b57795f9a94877df34a69ac39828620c58e2cf4b72cd7a9c253 On require, index.js loads loader.js, which reconstructs Cloudflare Workers hostnames from split string fragments e.g...