MAL-2026-13025 Malicious code in bnpl-molecule-mobile-bnpl-onboarding (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23d110510740ced78dc5855c7f9c0c3dedff3669ad49cb52aeee3c5467f00d3b On require of the package, index.js loads runtime.js which selects a platform-keyed asset linux/darwin/win32, downloads an opaque binary from one of...

Malicious code in bnpl-blocks-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 370e12396e25d7b72ad12f12c31c986e976bd8341f5fa61baa8cd3bb469f968e On require, index.js loads loader.js, which assembles a Cloudflare Workers hostname oob-worker.cf.workers.dev via runtime.join'' string reassembly,...

MAL-2026-13022 Malicious code in bnpl-blocks-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 370e12396e25d7b72ad12f12c31c986e976bd8341f5fa61baa8cd3bb469f968e On require, index.js loads loader.js, which assembles a Cloudflare Workers hostname oob-worker.cf.workers.dev via runtime.join'' string reassembly,...

MAL-2026-13023 Malicious code in bnpl-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b442dc0fb7678cca56e085cb17e0a3e5729eafc9fa34409f704fdcf5822a4efc index.js unconditionally requires./setup on load. setup.js constructs Cloudflare Workers hostnames via string-splitting array joins e.g...

Malicious code in bnpl-blocks-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5570ecd44264d28f2c2378da5c6cd23e562e696687adb01ab10b373c91e6560 On require of bnpl-blocks-types, index.js loads helpers.js which selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac,...

MAL-2026-13020 Malicious code in bnpl-blocks-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5570ecd44264d28f2c2378da5c6cd23e562e696687adb01ab10b373c91e6560 On require of bnpl-blocks-types, index.js loads helpers.js which selects a platform-specific path /pkg/package, /pkg/package.exe, /pkg/loadermac,...

MAL-2026-13024 Malicious code in bnpl-forms-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd6e149b86406225e3aca99e9bbae44cf13c0c7d5e10be27155162b63832f2f On require'bnpl-forms-test-utils', index.js loads platform.js, which selects a platform-specific endpoint and downloads an opaque binary via https.ge...

Malicious code in bnpl-blocks-types-gen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de78304bd1becbc9d7c967d281a308b18da039554be722990596f528180454f5 On require'bnpl-blocks-types-gen', top-level code in index.js invokes setup in platform.js, which selects a platform-specific binary path, downloads...

MAL-2026-13021 Malicious code in bnpl-blocks-types-gen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de78304bd1becbc9d7c967d281a308b18da039554be722990596f528180454f5 On require'bnpl-blocks-types-gen', top-level code in index.js invokes setup in platform.js, which selects a platform-specific binary path, downloads...

Malicious code in checkout-mobile-bnpl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0734507ccd6f61cb81c277d9e9215c90f0b8cff1bd16f0c3eacd399750d26b4f index.js requires./helpers on load. helpers.js reconstructs three Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

MAL-2026-12675 Malicious code in ded-pwa-bnpl-forms-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3094b607c6a3b342b1e8a4d7a3acde686d9fba41a68d430e08cda12dd9b0bca On require of the package, index.js loads support.js which executes at import time: it selects a platform-specific output path, downloads a binary...

MAL-2026-12384 Malicious code in form-bnpl-dolyame-component-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f48cc3ab15e35aac9a2c38a8f16c695d84e17e2b742e99f5b0c0a3947a6cda On require of the package, polyfill.js selects a platform-specific binary and downloads it over HTTPS from Cloudflare Workers subdomains whose...

Malicious Package

Overview dolyame-boxy-independent-bnpl-open-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious Package

Overview dolyame-boxy-independent-bnpl-title is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview dolyame-boxy-independent-bnpl-documents is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizatio...

Malicious Package

Overview dolyame-boxy-independent-bnpl-table is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview dolyame-boxy-desktop-bnpl-footer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview dolyame-boxy-desktop-bnpl-picture-gallery is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview dolyame-boxy-desktop-bnpl-card-panel is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview dolyame-boxy-independent-bnpl-partners is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...