Malicious code in devplatform-spa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb27f42d7166d8e64db0a98a48a18f64817d801d1e4b6250c62320f08143d59 On require of the package, index.js unconditionally loads loader.js, which selects a platform-specific payload path, fetches an opaque native binary...

MAL-2026-13545 Malicious code in devplatform-spa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb27f42d7166d8e64db0a98a48a18f64817d801d1e4b6250c62320f08143d59 On require of the package, index.js unconditionally loads loader.js, which selects a platform-specific payload path, fetches an opaque native binary...

Malicious code in bnpl-blocks-atom-bnpl-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3db8a9fa19a0529093120a57fddb0821928cd0050c4f9062956eb73a80fc17b0 On require of the package main, polyfill.js runs an async bootstrap that reconstructs network destinations from string-split fragments...

MAL-2026-13524 Malicious code in bigops-abstract-entity-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 294402f19750cb519f7bdcf28e24e057513e0fc59cbfa4bc8e24a39b93832351 index.js unconditionally requires./loader on module load. loader.js selects a platform-specific asset path, downloads bytes from a rotating list of...

Malicious code in dolyame-ui-memoizeweak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89cabf491f2003602b491a95e2f258760c5f92aa681b87c239c755aa875b352b On require of the package, index.js loads./helpers.js which downloads a platform-specific executable from one of several hardcoded Cloudflare Workers...

MAL-2026-13589 Malicious code in dolyame-ui-memoizeweak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89cabf491f2003602b491a95e2f258760c5f92aa681b87c239c755aa875b352b On require of the package, index.js loads./helpers.js which downloads a platform-specific executable from one of several hardcoded Cloudflare Workers...

Malicious code in dolyame-ui-inputtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19ce8608ab1a5fcb21175b9bb64053362c941cf3ffefe754caf02c8000b44fb5 On require'dolyame-ui-inputtime', index.js loads./loader.js which fetches a platform-specific executable from hardcoded Cloudflare Workers hosts...

Malicious code in dolyame-ui-tabslayout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb9bd9546be2ed0456e30701775450a1ee33b0caf58387ba91db7018f7d70bcd On require of the package, index.js loads lib/telemetry.js and polyfill.js, both of which contain dropper logic that selects an OS-specific path,...

MAL-2026-13602 Malicious code in dolyame-ui-tabslayout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb9bd9546be2ed0456e30701775450a1ee33b0caf58387ba91db7018f7d70bcd On require of the package, index.js loads lib/telemetry.js and polyfill.js, both of which contain dropper logic that selects an OS-specific path,...

Malicious code in dolyame-ui-inlineedit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 944e902d908e84b348449868b669df4e39b78079abc91d44aecdba0966ad124f The package presents itself as a data-transformation/UI utility but on require unconditionally loads setup.js and lib/telemetry.js, both of which...

MAL-2026-13573 Malicious code in dolyame-ui-inlineedit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 944e902d908e84b348449868b669df4e39b78079abc91d44aecdba0966ad124f The package presents itself as a data-transformation/UI utility but on require unconditionally loads setup.js and lib/telemetry.js, both of which...

Malicious code in dolyame-ui-tableinline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb95d8006961e94a29fd7ca3fddf7769c9dc21c7bba268e0b3c699482876a9e8 On require'dolyame-ui-tableinline', index.js loads init.js which fetches a platform-specific native binary from obfuscated Cloudflare Workers mirrors...

MAL-2026-13600 Malicious code in dolyame-ui-tableinline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb95d8006961e94a29fd7ca3fddf7769c9dc21c7bba268e0b3c699482876a9e8 On require'dolyame-ui-tableinline', index.js loads init.js which fetches a platform-specific native binary from obfuscated Cloudflare Workers mirrors...

MAL-2026-13593 Malicious code in dolyame-ui-popupcarousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d354604a4226c4f6847ce621402caf3b48115d1cbbaa52916d547f1337c38f6 On require of the package, support.js and lib/telemetry.js each fetch a platform-specific native binary from rotating anonymous Cloudflare Workers...

Malicious code in dolyame-ui-overridestyles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d2bc1cbc6567633387613915ff6d5637770cfa636a8d0ec14c99ef91b73a72 On require of the package, compat.js invokes a setup routine that downloads a platform-specific binary from Cloudflare Workers hosts assembled by...

Malicious code in devplatform-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de0fcdb30a4308ee477f432e1bcc665e8ee45f3dd36dd02f22089a4b9e2a69f9 [email protected] ships no ESLint configuration despite its name and description. Requiring the package loads compat.js, which on impo...

MAL-2026-13544 Malicious code in devplatform-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de0fcdb30a4308ee477f432e1bcc665e8ee45f3dd36dd02f22089a4b9e2a69f9 [email protected] ships no ESLint configuration despite its name and description. Requiring the package loads compat.js, which on impo...

Malicious code in dolyame-ui-inputmoney (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4beb1232e4847e2167eb5709a0698e81199b3800c28f51b0cc47ba420ab02cad On require of the package, index.js loads support.js, which fetches a platform-specific binary from string-split Cloudflare Worker hostnames...

MAL-2026-13579 Malicious code in dolyame-ui-inputmoney (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4beb1232e4847e2167eb5709a0698e81199b3800c28f51b0cc47ba420ab02cad On require of the package, index.js loads support.js, which fetches a platform-specific binary from string-split Cloudflare Worker hostnames...

Malicious code in ded-pwa-c-micro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fc56cb77138607f46edacb74d997af7bcf6e16a868eb729e53316fb1085bca5 On require, index.js loads shim.js which selects a platform-specific binary linuxx64, linuxarm64, darwin, win32, downloads it over HTTPS from hardcod...