MAL-2026-13497 Malicious code in ded-pwa-c-page-maker-props (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e3ee97f7402c39b73312351f193309dd6cd6e21704c8ee384e8e74e76cca0da On require of the package, compat.js selects a platform-specific endpoint and fetches an opaque binary from string-obfuscated Cloudflare Workers host...

MAL-2026-13315 Malicious code in dolyame-boxy-independent-bnpl-code-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7222a6cf31e1412fd943bcf3b140b02f6c615b1650f9c39cabf813801557ae On require of the package, index.js loads ext.js which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers hosts...

MAL-2026-13086 Malicious code in boxy-storybook-addon-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ec351f143fde732be84b60d329ba254cda918df3ebb25882371a8c5d96a3dd0 On require of the package, index.js loads ext.js which downloads an opaque platform-specific binary from one of four hardcoded Cloudflare Workers hos...