MAL-2026-12893 Malicious code in bnpl-blocks-atom-bnpl-skeleton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2e88e9faf590414055ba1b7b48bdaa51df5e33735b9dd526e5d8d0650eceae7 On require of the package's main entry, init.js fetches a platform-specific binary from obfuscated Cloudflare Workers hostnames assembled by joining...

Malicious code in checkout-input-email-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f845143d537f4590a200285bce69801a27e5c73a1080212bae23c392c43841 On require, bridge.js assembles attacker-controlled hostnames from split-string fragments oob-worker.cf103-070.workers.dev,...