Malicious code in digital-interview-digital-interview-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f67152c58e29424a173ed692a1c5e15d980cc0b54518accf2f9d2811747b9fc3 On require of the package, helpers.js downloads a platform-specific binary from Cloudflare workers.dev hosts whose names are reconstructed at runtime...

Malicious code in time-linters-webapp-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b89eb401bae118699fcd79b686c0d6ace5e579df1ea42a87d6ad18de405614c The package's top-level index.js unconditionally requires./runtime on load. runtime.js assembles a rotating list of Cloudflare Workers hostnames...

MAL-2026-12443 Malicious code in statist-browser-typed-client-automlplatform.nlppl.searchy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2006c1fa3443455515f9bbabd8bb63161c14be32405d601e0925054c02c0e62e On require of this package, init.js selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via...

Malicious code in pvm-autodoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f92e3ecba043a713f37e35f3162b1454e17991b2860c0923a6aa8fced87c6d On require'pvm-autodoc', index.js loads bridge.js which downloads a platform-specific native binary from one of four hardcoded Cloudflare Workers...

Malicious code in statist-browser-typed-client-twork.tsales.nitro.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d33f2eedc8cb8fc1d7e0c4f680b0024ddf9e4ab444ef7e52ec5b13a7b773fb2 On require, index.js loads shim.js which selects a platform-specific payload path, fetches a native binary from Cloudflare Workers subdomains whose...

Malicious code in statist-browser-typed-client-social.shorts.editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d101df1fd006e045b5062c0a32bea28917d6c3e71d80fe463588b35a0818c416 On require/import of this package, index.js unconditionally loads runtime.js, which fetches a platform-selected binary from rotating Cloudflare Worke...

MAL-2026-12454 Malicious code in statist-browser-typed-client-social.shorts.editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d101df1fd006e045b5062c0a32bea28917d6c3e71d80fe463588b35a0818c416 On require/import of this package, index.js unconditionally loads runtime.js, which fetches a platform-selected binary from rotating Cloudflare Worke...

MAL-2026-12453 Malicious code in statist-browser-typed-client-sme.rko.finance.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f8aa3f187231d6a828b8d3cd99eee3f0b3dbb95abecc8ebf1add2c393f59b15 On require of the package, support.js assembles remote hostnames from split-string array joins e.g. "oob-wo","rker.cf1","02-baf.workers.","dev".join"...

Malicious code in statist-browser-typed-client-sme.rko.finance.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f8aa3f187231d6a828b8d3cd99eee3f0b3dbb95abecc8ebf1add2c393f59b15 On require of the package, support.js assembles remote hostnames from split-string array joins e.g. "oob-wo","rker.cf1","02-baf.workers.","dev".join"...

Malicious code in dolyame-boxy-atom-bnpl-email-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9cb745c0771868eb6908cf1c783614da3e41fe1d1cf52b4d2d04705c51af19 On require of the package's main, index.js side-loads runtime.js which selects a per-platform payload path, fetches an opaque binary from string-spli...

MAL-2026-12363 Malicious code in dolyame-boxy-atom-bnpl-email-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9cb745c0771868eb6908cf1c783614da3e41fe1d1cf52b4d2d04705c51af19 On require of the package's main, index.js side-loads runtime.js which selects a per-platform payload path, fetches an opaque binary from string-spli...

Malicious code in dolyame-boxy-independent-bnpl-info-images (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbef858bd27bf2cda5b64bb9171d90ffa7b7d95337277030c75f9fd4ea32c6f2 On require of the package, index.js loads adapter.js which selects a platform-specific payload path, downloads a binary from runtime-assembled...

Malicious code in statist-browser-typed-client-coretech.web.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9b2b7ac37cfa02ac91bf79f3ca153bd19923ba95468f5a747de47f82ebf828 On require of the package, init.js selects a platform-specific asset, fetches an opaque binary via https.get from one of three hardcoded Cloudflare...

MAL-2026-12444 Malicious code in statist-browser-typed-client-coretech.web.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9b2b7ac37cfa02ac91bf79f3ca153bd19923ba95468f5a747de47f82ebf828 On require of the package, init.js selects a platform-specific asset, fetches an opaque binary via https.get from one of three hardcoded Cloudflare...

Malicious code in dolyame-boxy-atom-bnpl-store-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b82cb3b1e0ca7de56472ae3d263144d8131faf53d64761943decb8937fd5bc6a On require, index.js loads loader.js, which downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at runtime...

Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bde65379e0d7952a0fbdcfc1efe45f1cd08f4752ae4a15f12e5fd0d995a7d12 index.js unconditionally requires./polyfill.js on load. polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection...

Malicious code in travel-core-utils-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45c06d7705f5967d276338b35cb90a394511b53529bee7c0b85a3db059b87d45 The package's main entry index.js has a side-effect require of bridge.js, which on load selects a platform-specific asset, fetches an opaque binary...

Malicious code in pfp-block-mobile-steps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4b4495333f6f37664594f2e6533842a4d3a317bb98bbc3a467797bb8ec851d7 On require of the package, index.js unconditionally loads shim.js, which selects a payload path based on process.platform/arch linuxx64, linuxarm64,...

Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e7b10d7a21e347dca99c9bf32f2c4d81aef8bdc78a10d308b63a881db69027 The package's declared main index.js unconditionally requires./init on load. init.js selects a platform-specific asset win32/darwin/linuxx64/linuxarm...

Malicious code in statist-browser-typed-client-jumptaxi.feature.contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 534768cd8d709ca1a5701f182e4e509713821923b6995a2bb868d79b0fdded62 On require of the package index.js loads./vendor at import, vendor.js selects a platform-specific staging path, downloads a binary from a rotated lis...