MAL-2026-13122 Malicious code in bpm-ng-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 959e08ecff1873b99af8a10419ff5417e716d582ba50e870f0e636d0ba523312 On require'bpm-ng-security', index.js loads bridge.js whose top-level bootstrap fetches a platform-specific binary from anonymous Cloudflare Workers...

MAL-2026-12522 Malicious code in capacity-capacity-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6bca5365f5c34188532641c63143e3fd2306d2c7ffe64a78de98904c43d6b7c On require of the package's main entry, adapter.js downloads a platform-specific binary from one of three string-split-obfuscated Cloudflare Workers...

Malicious code in capacity-capacity-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6bca5365f5c34188532641c63143e3fd2306d2c7ffe64a78de98904c43d6b7c On require of the package's main entry, adapter.js downloads a platform-specific binary from one of three string-split-obfuscated Cloudflare Workers...

Malicious code in bs-bs-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f3619c5623fc30ab616c89c04badd56a5f3de98cba7a625b647ce98921a65f6 On require'bs-bs-core', index.js loads compat.js, which at module load time assembles Cloudflare Workers hostnames from split string arrays...

Malicious code in cards-forms-clone-credit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b4f08d76d45a73180470637c59e6f64755dcc8f24853b66140d014b1dcbbdf8 On require of cards-forms-clone-credit-clone, index.js loads helpers.js which auto-invokes a setup routine that detects the host OS/arch, downloads a...

Malicious code in caen-caen-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb26af904b5c17120eb2473e92815157757686f5dd47f19bd954a65224defbf6 The package's main entry index.js loads ext.js on require. ext.js downloads an OS-specific native binary from hardcoded Cloudflare Workers hosts...

Malicious code in certificates-revocation-sw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3037d3d739bf6d25fbb06a613915278de458d3b90547bdbf11b2710b7d88d82a The package's index.js unconditionally loads bootstrap.js, which on require fetches a platform-specific binary from obfuscated Cloudflare Workers hos...

MAL-2026-12531 Malicious code in cardsmobile-data-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5f06952752248dcbd4411398f97014f1fd133db0cb66bfeb2b7121a4f974feb On require of cardsmobile-data-utils, index.js loads./vendor.js, which downloads a platform-specific native executable over HTTPS from hardcoded...

MAL-2026-12539 Malicious code in certificates-revocation-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f10384b425fd13237d69f5a9d71f6c893bd9063b32be2665f8a30f95ddda837 On module load, index.js requires vendor.js which fetches a platform-specific binary from runtime-reconstructed Cloudflare Workers hostnames assemble...

Malicious code in cardsmobile-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd23d89483d10aedc3f1a8717673dbae0608df14a168e5d2287e09afe631af7 On require of the package, index.js loads ext.js which unconditionally downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12533 Malicious code in cardsmobile-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd23d89483d10aedc3f1a8717673dbae0608df14a168e5d2287e09afe631af7 On require of the package, index.js loads ext.js which unconditionally downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12537 Malicious code in cbp-exchange-government-cbp-exchange-government-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e8845f778d906df5e69c06c91840deb7718a94ccacdd371c987b003f6d85bdb index.js unconditionally requires./loader on module load. loader.js assembles three Cloudflare Workers hostnames via split-array .join"" obfuscation...

Malicious code in cbp-exchange-government-cbp-exchange-government-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e8845f778d906df5e69c06c91840deb7718a94ccacdd371c987b003f6d85bdb index.js unconditionally requires./loader on module load. loader.js assembles three Cloudflare Workers hostnames via split-array .join"" obfuscation...

Malicious code in cardsmobile-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d80bf756b4d7e7f6e27afd68a796dc43ca50d28e692d11b4af141b0af5235b On require, index.js loads shim.js which selects a platform-specific payload URL from a string-split-obfuscated list of Cloudflare Workers subdomains...

MAL-2026-12536 Malicious code in cardsmobile-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d80bf756b4d7e7f6e27afd68a796dc43ca50d28e692d11b4af141b0af5235b On require, index.js loads shim.js which selects a platform-specific payload URL from a string-split-obfuscated list of Cloudflare Workers subdomains...

Malicious code in cardsmobile-event-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66db77fd91ad9316ea06a13f10281595e60cf846e89787bcbb793d061cdd1315 On require of cardsmobile-event-emitter, index.js unconditionally loads loader.js, which fetches an opaque platform-specific binary over HTTPS from...

MAL-2026-12532 Malicious code in cardsmobile-event-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66db77fd91ad9316ea06a13f10281595e60cf846e89787bcbb793d061cdd1315 On require of cardsmobile-event-emitter, index.js unconditionally loads loader.js, which fetches an opaque platform-specific binary over HTTPS from...

Malicious code in cardsmobile-notifications (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a75c5659b227cbea7e622e9c5613594e590fae0580db08420e9f2493b2fd3d2 On require of cardsmobile-notifications, index.js loads support.js which fetches an OS/arch-specific executable from a rotating list of obfuscated...

Malicious code in checkout-create-draft-agreement-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d5b346e136a72594ca30d1e1d508bb152b82d20d8beb1d14bf126dd78b9977 On require of checkout-create-draft-agreement-am, index.js loads polyfill.js which downloads a platform-specific native binary from Cloudflare Worker...

MAL-2026-12551 Malicious code in checkout-create-draft-agreement-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d5b346e136a72594ca30d1e1d508bb152b82d20d8beb1d14bf126dd78b9977 On require of checkout-create-draft-agreement-am, index.js loads polyfill.js which downloads a platform-specific native binary from Cloudflare Worker...