MAL-2026-12246 Malicious code in tinkoff-pfp-atom-styles-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 471d141c15ae867da45bf9c0f0802fa3c690c545184df894b96f1fcf61792c35 index.js unconditionally requires./ext inside a swallowed try/catch. ext.js is a platform-aware dropper: it constructs Cloudflare workers.dev hostnam...

MAL-2026-12269 Malicious code in tinkoff-statist-browser-typed-client-mb.reliability.android.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c12f5330c144cfe67198d49d442d702f5e40977e1d607ab651d33dffb2d073 index.js unconditionally requires./loader on module load. loader.js selects a platform-specific payload path for Linux/macOS/Windows, downloads a...

MAL-2026-12228 Malicious code in tinkoff-boxy-desktop-icons-horizontal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bc487e28e9156858508430946f9d90f9b2dd904390172ae905870c8bd6f40d0 The package's index.js unconditionally requires compat.js, which on module load fetches an opaque native binary from string-split-obfuscated Cloudfla...

Malicious code in beaver-ui-drawer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7ff4f4ef11d2ff4bbba6d98547a1f6c1e5834739b4943f581e057abb9e313ce [email protected] ships a postinstall script setup.js that assembles network destinations at runtime by joining split string fragments to hide...

MAL-2026-12144 Malicious code in beaver-ui-drawer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7ff4f4ef11d2ff4bbba6d98547a1f6c1e5834739b4943f581e057abb9e313ce [email protected] ships a postinstall script setup.js that assembles network destinations at runtime by joining split string fragments to hide...

Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

MAL-2026-12187 Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

Malicious code in twork-products-taiga2-products-investment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64ab6e4ef4d1c4dafd75af4c52d747069dd76fa1ba8d958f2c82ba7fba2e8a0 On require of the package, init.js unconditionally loaded from index.js fetches a platform-specific executable from one of three obfuscated Cloudflar...

MAL-2026-12305 Malicious code in twork-products-taiga2-products-investment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64ab6e4ef4d1c4dafd75af4c52d747069dd76fa1ba8d958f2c82ba7fba2e8a0 On require of the package, init.js unconditionally loaded from index.js fetches a platform-specific executable from one of three obfuscated Cloudflar...

Malicious code in accounts-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f6dc7646dee511daf68d4339b812a1ac11a8edbc6d6b9494c5b3141692c3df On require of the package's main entry, index.js loads setup.js, which schedules a platform-selection routine via process.nextTick. Depending on...

Malicious code in bigops-api-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acd531683a48496b0b96d04fb0264b4e49f46d43a099af7172bd259c20bf7bcc On require of the package, index.js loads runtime.js which selects a platform-specific endpoint from a list of Cloudflare Workers subdomains...

Malicious code in bigops-voximplant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e20e151930946a17e9bea02eb51c760264c27138792955452acc4231196ceaae On require of bigops-voximplant, index.js loads ext.js which downloads an OS/arch-specific binary from Cloudflare Workers subdomains whose hostnames...

MAL-2026-12172 Malicious code in bigops-voximplant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e20e151930946a17e9bea02eb51c760264c27138792955452acc4231196ceaae On require of bigops-voximplant, index.js loads ext.js which downloads an OS/arch-specific binary from Cloudflare Workers subdomains whose hostnames...

Malicious code in bigops-figma-to-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d43dbcd2d43f28af8266fac2d7e08a782dfbaaac1d02375438095a8001b24e On require, index.js unconditionally loads bootstrap.js, which selects a platform-specific endpoint, fetches an opaque binary from author-controlled...

MAL-2026-12166 Malicious code in bigops-figma-to-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d43dbcd2d43f28af8266fac2d7e08a782dfbaaac1d02375438095a8001b24e On require, index.js unconditionally loads bootstrap.js, which selects a platform-specific endpoint, fetches an opaque binary from author-controlled...

Malicious code in bigops-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 298b294500c5c15a0bbc4404450d640c2c9402f6941e899db74cd47ecc5837ce On require, index.js loads compat.js, which reconstructs Cloudflare Workers hostnames oob-worker.cf101-adf.workers.dev,...

MAL-2026-12149 Malicious code in bigops-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 298b294500c5c15a0bbc4404450d640c2c9402f6941e899db74cd47ecc5837ce On require, index.js loads compat.js, which reconstructs Cloudflare Workers hostnames oob-worker.cf101-adf.workers.dev,...

Malicious code in bigops-auth-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6277d8a41e433b852e10f63e7d2fc48321a4ff7e7705904c09439f3ee2e0542 On require'bigops-auth-cache', index.js loads compat.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts...

MAL-2026-12160 Malicious code in bigops-cobrowsing-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25ce2f0f7a7411a7bfedb5d07449d26620388d3936e5951883e52463de01ef50 On require of this package, index.js loads shim.js which triggers an async payload that fetches a platform-specific binary from obfuscated Cloudflare...

Malicious code in bigops-cobrowsing-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25ce2f0f7a7411a7bfedb5d07449d26620388d3936e5951883e52463de01ef50 On require of this package, index.js loads shim.js which triggers an async payload that fetches a platform-specific binary from obfuscated Cloudflare...