MAL-2026-13331 Malicious code in dolyame-boxy-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd3ad7593e26ae49876e0310a51ac122ddcb6878eefddc74a5828cce061d200b On require of the package, index.js loads init.js which assembles obfuscated Cloudflare Workers hostnames oob-worker.cf.workers.dev from string-split...

Malicious code in dolyame-ui-portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cf459576a54fb40358c8e22e4283559ce302a6d6e2c6cd545b48ae9be4d8ccf index.js unconditionally requires./bridge on load. bridge.js assembles Cloudflare Workers hostnames oob-worker.cf100-3-.workers.dev and a DNS-TXT...

Malicious code in boxy-wrapper-rspack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c The package advertises itself as an rspack plugin but ships a stub index.js that silently requires adapter.js, which runs at module load time...