Malicious code in dolyame-ui-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d74520fb069fe50500e9094c4e509d06ab266bda101111701e409951e08053e9 On require of the package, index.js loads shim.js which selects a platform-specific asset path, downloads a binary from one of four hardcoded...

Malicious code in dolyame-ui-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f8bf970c387898705de052ea5736f3f90877cfcdad204af1a772b5230c95c31 On every require of dolyame-ui-layout, index.js loads platform.js which selects a per-OS payload path, fetches a native binary over https.get from...

Malicious code in dolyame-ui-popover (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ed3996792c8c70963eee2871d056f13b90e873087ff77be677c7cb359058b9f On require of the package, index.js loads ext.js which selects an OS/arch-specific endpoint and downloads a binary from hardcoded Cloudflare Workers...

MAL-2026-13195 Malicious code in dolyame-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c23ba8923130746ecc1e526c3a0ee8961ea764dd90d0da71236444d978ce27 dolyame-ui-themes ships a loader.js that is required from the package main index.js at module load. The loader reconstructs C2 hostnames from split...

MAL-2026-13261 Malicious code in devplatform-spa-plugin-s3-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d2d2addbad66de5b68e55eb91db20968268ed1f7a951835a35aef1159e4af41 On require of devplatform-spa-plugin-s3-router, index.js loads helpers.js which runs a bootstrap routine at module load. The code assembles Cloudflar...

MAL-2026-12839 Malicious code in bigops-tcrm-permissions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a20b19aa6d3666cf99d03011aefd683f0d560b45dac6f27c2915dd68dd95bc0d On require of bigops-tcrm-permissions, index.js loads runtime.js which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in bigops-tcrm-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f4cc9ef61d16a5c70a1adc9c2ab3acb9e51d650967f02621410285d99efd4a1 The package's main index.js requires./setup on load. setup.js selects a platform-specific payload path, downloads a native binary over HTTPS from...

Malicious code in bnpl-blocks-atom-bnpl-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9b4cea9f3ecb85954dffb42aac8b9869e662493ae87815a7feb8c293e398b79 On require of the package, index.js loads./platform.js which fetches an opaque executable payload from obfuscated Cloudflare Workers hosts...

MAL-2026-12968 Malicious code in bnpl-blocks-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 386248e103371d4e302c8325a3d1b76c4269256b1c374c95f539104230f60149 The package ships a loader loader.js that assembles remote hostnames at runtime from string-split arrays reconstructing subdomains of wel1.ru and a...

Malicious code in bnpl-blocks-mobile-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3362a69d0a3341fff7a48ebdd4a8231ec5a365dc237c62a5b95619fe051e762 On require, index.js loads bootstrap.js, which selects a per-platform payload path, fetches a binary over HTTPS from hardcoded hosts assembled by...

Malicious code in bnpl-blocks-post-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd5d8d3c9328912323fee5066e4c32c14904ec3e8b1800f66da0d1749babda0c On require, polyfill.js reconstructs attacker-controlled hostnames from string-split fragments oob-worker.cf103-070.workers.dev, with a DNS-TXT...

MAL-2026-13071 Malicious code in boxy-mmb-deps-pvm-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 088639f9b19ce8234cef116c0250628c6894bd509915aa90639c56436ec19646 index.js unconditionally loads polyfill.js on require. polyfill.js reconstructs attacker-controlled hostnames from split string literals...

MAL-2026-13091 Malicious code in boxy-test-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a5cc17bc186bfb165d7341ea7832b66bc93cafaa6f849ccc840660735c0cfa5 On require of the package, index.js loads ext.js which assembles C2 hostnames from split string fragments oob-worker.cf102-baf.workers.dev,...

MAL-2026-13083 Malicious code in boxy-sitree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2be12f6af3487a38f7fa17ee8a4fd8a910f9dccffa351a8e19545781b2dfd3bc Requiring boxy-sitree triggers shim.js, which selects a platform-specific binary path, fetches an executable from Cloudflare Workers hosts assembled ...

Malicious code in boxy-storybook-addon-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ec351f143fde732be84b60d329ba254cda918df3ebb25882371a8c5d96a3dd0 On require of the package, index.js loads ext.js which downloads an opaque platform-specific binary from one of four hardcoded Cloudflare Workers hos...

Malicious code in bpm-foundation-renovate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a14b30ee8591115098467b468c9e7bb84ae57d52b7d7cdf36799e0a95f94a439 On require of the package, index.js loads helpers.js which selects a platform-specific endpoint, downloads a binary from a rotating list of Cloudflar...

Malicious code in cardsmobile-data-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5f06952752248dcbd4411398f97014f1fd133db0cb66bfeb2b7121a4f974feb On require of cardsmobile-data-utils, index.js loads./vendor.js, which downloads a platform-specific native executable over HTTPS from hardcoded...

Malicious code in checkout-accounts-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a On require'checkout-accounts-holder', index.js loads platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames...

MAL-2026-12541 Malicious code in checkout-accounts-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a On require'checkout-accounts-holder', index.js loads platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames...

Malicious code in checkout-confirm-pos-order-sms-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e On require of this package, index.js loads init.js which invokes init immediately. init downloads an opaque binary from hardcoded Cloudflare Workers...