Malicious code in candy-candy-core (npm)

Source: amazon-inspector f6eb2dd43ce21b00ec40ac6df2c7eee73a20e090d923e5d08c2fd48c01b82eb5 Requiring candy-candy-core loads index.js which unconditionally requires./polyfill.js. polyfill.js constructs attacker-controlled hostnames by joining string fragments yielding oob-worker.cf99-9b3.workers.de...

MAL-2026-12521 Malicious code in candy-candy-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6eb2dd43ce21b00ec40ac6df2c7eee73a20e090d923e5d08c2fd48c01b82eb5 Requiring candy-candy-core loads index.js which unconditionally requires./polyfill.js. polyfill.js constructs attacker-controlled hostnames by joinin...

Malicious code in candy-candy-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6eb2dd43ce21b00ec40ac6df2c7eee73a20e090d923e5d08c2fd48c01b82eb5 Requiring candy-candy-core loads index.js which unconditionally requires./polyfill.js. polyfill.js constructs attacker-controlled hostnames by joinin...