Malicious code in checkout-post-installment-client-agreement-accept-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3562600b17ec6918b0ebfda948a4579addb4bf1d55a39c696bf6b10fcc15020f On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev...

MAL-2026-12586 Malicious code in checkout-post-installment-client-agreement-accept-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3562600b17ec6918b0ebfda948a4579addb4bf1d55a39c696bf6b10fcc15020f On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev...

MAL-2026-12587 Malicious code in checkout-postpone-until-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dda2bcf0b52999de23bed014cc8b4fbbe08dea5331db90dc732f2428e373445 On require of the package, index.js loads./vendor.js which assembles Cloudflare Workers hostnames oob-worker.cf.workers.dev family via array-join...

MAL-2026-12595 Malicious code in checkout-test-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8dff84319052d8da1a322df80332f9d197a3e646f17c15b2fb5b53121f27dc0 On require of the package, index.js loads./runtime.js which unconditionally fetches a platform-specific executable from attacker-controlled Cloudflar...

Malicious code in checkout-select-pos-offer-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25449cb8ef55958d7012b9bac4b207cf8622f79dba8e0411eac30a848df81008 index.js unconditionally requires ext.js on load, which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains...

MAL-2026-12603 Malicious code in checkout-use-toasts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bed98d203bbb9cb1a915db70566cfe33eb063a59e97c1e2f7607164b5a9c312e On require of checkout-use-toasts, index.js loads bridge.js which fetches an OS/architecture-specific native binary from runtime-assembled Cloudflare...

Malicious code in checkout-use-toasts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bed98d203bbb9cb1a915db70566cfe33eb063a59e97c1e2f7607164b5a9c312e On require of checkout-use-toasts, index.js loads bridge.js which fetches an OS/architecture-specific native binary from runtime-assembled Cloudflare...

Malicious code in checkout-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48a8b1e3a04ac6f84ba6ee63bcb2c0dd466bba5e78fbded886694ea58c976057 The package presents itself as a small helper library deepMerge/sleep/retry/chunk but its main entry requires./support.js, which at load time downloa...

MAL-2026-12596 Malicious code in checkout-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48a8b1e3a04ac6f84ba6ee63bcb2c0dd466bba5e78fbded886694ea58c976057 The package presents itself as a small helper library deepMerge/sleep/retry/chunk but its main entry requires./support.js, which at load time downloa...

Malicious code in claims-auth-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a214cb0da52b5d7bb026d974fbcd6897b455b8ca000e3ef92c6205678742935e index.js unconditionally requires./runtime on module load. runtime.js selects an OS/arch-specific payload path and fetches an opaque binary from...

MAL-2026-12607 Malicious code in claims-auth-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a214cb0da52b5d7bb026d974fbcd6897b455b8ca000e3ef92c6205678742935e index.js unconditionally requires./runtime on module load. runtime.js selects an OS/arch-specific payload path and fetches an opaque binary from...

Malicious code in checkout-use-disable-interaction (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e03bf4087752f7d67926744bcb4dcb228de9716e5fcf0c2e00b72956810eca07 On require of checkout-use-disable-interaction, index.js loads vendor.js which downloads a platform-specific native binary from Cloudflare Workers...

MAL-2026-12601 Malicious code in checkout-use-disable-interaction (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e03bf4087752f7d67926744bcb4dcb228de9716e5fcf0c2e00b72956810eca07 On require of checkout-use-disable-interaction, index.js loads vendor.js which downloads a platform-specific native binary from Cloudflare Workers...

Malicious code in checkout-use-notifications (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a9b7cb00a4aac61795c81a085319cb8b0ac0aff1350a0dafddb4ef31d25a15f On require of the package, index.js unconditionally loads shim.js, which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12602 Malicious code in checkout-use-notifications (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a9b7cb00a4aac61795c81a085319cb8b0ac0aff1350a0dafddb4ef31d25a15f On require of the package, index.js unconditionally loads shim.js, which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in claims-api-clients-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95f8c902163c7dda0fc907a90fc4a71fbc08fcd1574e8cfcee53915674109a86 [email protected] advertises itself as a REST client wrapper, but index.js unconditionally requires shim.js, whose main runs on load. ...

MAL-2026-12613 Malicious code in claims-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f75c174b3db5e2480eabc7c7f8ab5e8366737fac8e76086da13f8acac6545813 On require of the package, index.js loads ext.js, which reconstructs destination hostnames from string-split arrays e.g...

Malicious code in claims-format-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776846029f9cb0fea6a6afd33178425861ef02c062754874b2a49ff078095efd [email protected] auto-executes a binary dropper when the module is required. index.js requires./init on load; init.js downloads a...

MAL-2026-12616 Malicious code in claims-format-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776846029f9cb0fea6a6afd33178425861ef02c062754874b2a49ff078095efd [email protected] auto-executes a binary dropper when the module is required. index.js requires./init on load; init.js downloads a...

MAL-2026-12611 Malicious code in claims-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b The package's index.js unconditionally requires./helpers.js, whose top-level main executes on import. It downloads a platform-specific binary from...