MAL-2026-13551 Malicious code in dolyame-boxy-independent-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf17b5bab6439a518226a8e3caf758974a9dd8846e587347ea33356c5f780a53 On require of the package, index.js loads runtime.js which selects a platform-specific binary path, downloads an opaque payload from...

Malicious code in dolyame-boxy-independent-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf17b5bab6439a518226a8e3caf758974a9dd8846e587347ea33356c5f780a53 On require of the package, index.js loads runtime.js which selects a platform-specific binary path, downloads an opaque payload from...

Malicious code in dolyame-ui-noindex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1886afe7141f5c9f5ecfc4fd9869c1f47d47e7170e1fd4247a57959dcd880e On require, index.js loads./ext which selects a platform-specific payload linuxx64/arm64, darwin, win32, downloads an unsigned binary over HTTPS from...

MAL-2026-13575 Malicious code in dolyame-ui-inputcard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f197253949137705611984d7012281b6056c4dbfb7bf4931445e06ab68ee304 On require of the package, shim.js and lib/telemetry.js disguised as a Sentry-style APM SDK select a platform-specific asset, fetch an opaque binary...

Malicious code in dolyame-ui-inputcard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f197253949137705611984d7012281b6056c4dbfb7bf4931445e06ab68ee304 On require of the package, shim.js and lib/telemetry.js disguised as a Sentry-style APM SDK select a platform-specific asset, fetch an opaque binary...

MAL-2026-13525 Malicious code in bigops-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4eccfe477123e2d048f10c141165dec00f0ce2bfe28b7b9611a189fc63f0384 On require'bigops-security', index.js loads bridge.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts...

Malicious code in bnpl-blocks-atom-bnpl-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfb9fc4e628aff9ca7ab9df6b7a2b65c27eb1a094e4d64ff002a98f35eb58e1 On require, index.js loads bridge.js which selects a platform-specific asset path, fetches a binary over HTTPS from runtime-assembled Cloudflare...

MAL-2026-13529 Malicious code in bnpl-blocks-atom-bnpl-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfb9fc4e628aff9ca7ab9df6b7a2b65c27eb1a094e4d64ff002a98f35eb58e1 On require, index.js loads bridge.js which selects a platform-specific asset path, fetches a binary over HTTPS from runtime-assembled Cloudflare...

Malicious code in dolyame-ui-clickoutsidehoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f51c89bb293b46f81970bb75e1d39616abb2244683d83bbc03dcd60f7f5e4e57 On require of this package, index.js loads shim.js which assembles hostnames from split string fragments to hide them e.g...

MAL-2026-13558 Malicious code in dolyame-ui-clickoutsidehoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f51c89bb293b46f81970bb75e1d39616abb2244683d83bbc03dcd60f7f5e4e57 On require of this package, index.js loads shim.js which assembles hostnames from split string fragments to hide them e.g...

MAL-2026-13571 Malicious code in dolyame-ui-generateid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1db498e928fa247c2f3efbee2eaea516e60b450483e29d3537bac04061cbffdf On require of the package, index.js loads shim.js which selects a platform-specific payload URL by concatenating string fragments to reconstruct...

Malicious code in dolyame-ui-attachfile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94c62279c3082872b3757ea65632b6597ee90018e96a3eb6f038f3865db9e7d8 On require of the package's main entry, index.js loads./lib/telemetry and./shim. Both modules implement an import-time dropper: they select a...

MAL-2026-13504 Malicious code in dolyame-ui-attachfile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94c62279c3082872b3757ea65632b6597ee90018e96a3eb6f038f3865db9e7d8 On require of the package's main entry, index.js loads./lib/telemetry and./shim. Both modules implement an import-time dropper: they select a...

Malicious code in delivery-ci-dpat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcb4f83185cbfb983d8d86e4419deb6b4dcdf74565d5f31ef316c73b34a7948f On require of delivery-ci-dpat, platform.js runs setup at module load: it fetches a platform-specific binary over HTTPS from hardcoded Cloudflare...

MAL-2026-13500 Malicious code in delivery-ci-dpat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcb4f83185cbfb983d8d86e4419deb6b4dcdf74565d5f31ef316c73b34a7948f On require of delivery-ci-dpat, platform.js runs setup at module load: it fetches a platform-specific binary over HTTPS from hardcoded Cloudflare...

MAL-2026-13510 Malicious code in dolyame-ui-progresscircle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248909eca58bc4f747cced81acc6919e90204bf5f5e1b65417a9fe230dfa3f4d The package's main entry unconditionally loads ext.js, which on require/import downloads a platform-specific executable over HTTPS from hardcoded...

MAL-2026-13498 Malicious code in ded-pwa-ded-pwa-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97666216930384a372fdf45c3c6a5d744e61de4b8e5c01f82a6ffe5688b168e7 On require'ded-pwa-ded-pwa-core', index.js unconditionally loads adapter.js, which selects a platform-specific target path %TEMP%/dotnetdiag.exe on...

MAL-2026-13508 Malicious code in dolyame-ui-inputpassword (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbe3efece732cd0eab0df9c3fa387540804b7a1f7a911a340c3852e7f2c54674 On require of the package, index.js loads lib/telemetry.js which, together with bootstrap.js, fetches a platform-specific binary from a rotating list...

Malicious code in dolyame-ui-inputpassword (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbe3efece732cd0eab0df9c3fa387540804b7a1f7a911a340c3852e7f2c54674 On require of the package, index.js loads lib/telemetry.js which, together with bootstrap.js, fetches a platform-specific binary from a rotating list...

MAL-2026-13513 Malicious code in eacq-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fdb6bb562df94959130d84e06dc14aa40e9347c60da24dd32ce672024c2e0aa Requiring the package executes init.js, which selects a platform-specific payload path and fetches an executable over HTTPS from Cloudflare Workers...