Malicious code in bnpl-blocks-data-schema-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1e39c2d94a6114333c4275444d786188f00056a96e6e6296cd3abf275e3d5bc index.js unconditionally requires bootstrap.js, which on module load reconstructs Cloudflare Workers subdomains oob-worker.cf10x-xxx.workers.dev and...

Malicious code in bnpl-blocks-consts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7651f2c7c9ce4e13909a22f522b625f2bcf6825ced0641259c77e9d46ab56ede Package is advertised as a constants wrapper but requiring it loads polyfill.js, which on import asynchronously downloads a platform-specific...

MAL-2026-12905 Malicious code in bnpl-blocks-atom-image-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629920c8010c4cc8284a3698f4d748214d9ac784f67df8250ace5e656240ecb3 On require of the package, index.js loads setup.js which reconstructs attacker-controlled hostnames from split-string arrays...

Malicious code in bnpl-blocks-desktop-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6823826cd3999be6c3dac95d5731bbce9bee98ae0b7df019a3b85c97fd5d1bad The package is advertised as a UI footer component but side-loads bridge.js on require. bridge.js selects a platform-specific asset linux/darwin/win3...

MAL-2026-12923 Malicious code in bnpl-blocks-desktop-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6823826cd3999be6c3dac95d5731bbce9bee98ae0b7df019a3b85c97fd5d1bad The package is advertised as a UI footer component but side-loads bridge.js on require. bridge.js selects a platform-specific asset linux/darwin/win3...

Malicious code in bnpl-blocks-desktop-bnpl-grid-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f6433a65cdc6a8c5ce6486234ee3b6a17842ff9b51a9c33448a3dcf9dfcfd4d index.js unconditionally requires./setup.js, which on module load selects an OS/arch-specific asset path and downloads a binary from Cloudflare Worke...

MAL-2026-12924 Malicious code in bnpl-blocks-desktop-bnpl-grid-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f6433a65cdc6a8c5ce6486234ee3b6a17842ff9b51a9c33448a3dcf9dfcfd4d index.js unconditionally requires./setup.js, which on module load selects an OS/arch-specific asset path and downloads a binary from Cloudflare Worke...

MAL-2026-12918 Malicious code in bnpl-blocks-desktop-bnpl-category-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a277db0429a37308bb1ce8f4d8f051e7be7b04cf8c327c10b967d9a7b17da75b The package's main entry unconditionally requires support.js, which at load time fetches a platform-specific native binary from obfuscated Cloudflare...

Malicious code in bnpl-blocks-desktop-bnpl-category-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a277db0429a37308bb1ce8f4d8f051e7be7b04cf8c327c10b967d9a7b17da75b The package's main entry unconditionally requires support.js, which at load time fetches a platform-specific native binary from obfuscated Cloudflare...

MAL-2026-12925 Malicious code in bnpl-blocks-desktop-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c6b73a025a319c8c2af1d616239d0950f911030ae9760506d6090be908ca935 On require of this package, index.js loads bridge.js, which reconstructs C2 hostnames from split string fragments e.g...

Malicious code in bnpl-blocks-desktop-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8dabd39ff50be1e1295dea75e71b63acd26c7617be87af38df3cdbaaee53302 index.js loads support.js at require time, which fetches a platform-specific binary linux/darwin/win32 variants under /pkg/package, /pkg/loadermac,...

MAL-2026-12921 Malicious code in bnpl-blocks-desktop-bnpl-feedback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a55a8b87f5fcabb03e7b44b8f85aafe3a6b8a6a1f8799305b21544055e99845 index.js requires./init on load. init.js downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts...

MAL-2026-12919 Malicious code in bnpl-blocks-desktop-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8ebc784cdc9c083f42cf6323e773eb7bf43b1b927c936c609bb8d93a90bb4cb On any require/import of this package, index.js loads ext.js which downloads a platform-specific binary over HTTPS from string-split-obfuscated...

MAL-2026-12926 Malicious code in bnpl-blocks-desktop-bnpl-header-catalog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d77aab31095b1d13ea26c5ca29398e01a205ed0766fe95d5d8978751ebd75e35 The package presents itself as a 'logging middleware' but its index.js unconditionally requires loader.js on module load. loader.js selects a per-OS...

MAL-2026-12927 Malicious code in bnpl-blocks-desktop-bnpl-header-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1af1b8630f713bc29fd99f332ba8035b26022f01199e755f2909d3440019fff On require of the package, index.js loads adapter.js whose top-level main constructs Cloudflare Workers hostnames oob-worker.cf100-3-.workers.dev and...

MAL-2026-12943 Malicious code in bnpl-blocks-desktop-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53a00a782a1b951d114dd07c4e2e5bf08226730274beb0b88842034b5c71e9dd On require of the package, index.js unconditionally loads adapter.js, which selects a payload URL based on OS/arch and downloads a binary from one of...

Malicious code in bnpl-blocks-desktop-bnpl-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0de35e4aa0a895b91234b28bdbe2413b0c6d855758348954f2a438185165de00 On require of this package, index.js loads runtime.js which selects an OS/arch-specific payload URL, downloads an opaque binary from one of several...

MAL-2026-12946 Malicious code in bnpl-blocks-desktop-large-bnpl-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d52a16c390437bd38f791fca1380253d0e4e3056a1b1efd2af35f4fa95e22e28 On require of the package, index.js loads bridge.js which detects OS/arch and downloads a platform-specific binary from Cloudflare Workers hosts whos...

MAL-2026-12936 Malicious code in bnpl-blocks-desktop-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea9e8a4f62e56d4797cc04c34f92cb55312f74de4980d98853210716f020ee76 On require of the package, runtime.js selects an OS/arch-specific asset path and downloads a native binary over HTTPS from string-split Cloudflare...

MAL-2026-12939 Malicious code in bnpl-blocks-desktop-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a925d2ffafa8ffd0f27b1072b73d895eda640c78f1444312dcf9e09c92072216 On require of the package's main entry, shim.js unconditionally fetches a platform-specific binary over HTTPS from hardcoded hostnames assembled via...