MAL-2026-13023 Malicious code in bnpl-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b442dc0fb7678cca56e085cb17e0a3e5729eafc9fa34409f704fdcf5822a4efc index.js unconditionally requires./setup on load. setup.js constructs Cloudflare Workers hostnames via string-splitting array joins e.g...

Malicious code in boxy-adapter-tramvai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d20d5167abc8703b7b09a0d9698e6d0fd060f4378dfa11ab469af3e6805cfc8e On library load, index.js requires./runtime.js, which selects a platform-specific staging path, fetches an opaque binary from obfuscated Cloudflare...

MAL-2026-13028 Malicious code in boxy-adapter-tramvai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d20d5167abc8703b7b09a0d9698e6d0fd060f4378dfa11ab469af3e6805cfc8e On library load, index.js requires./runtime.js, which selects a platform-specific staging path, fetches an opaque binary from obfuscated Cloudflare...

Malicious code in bnpl-forms-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd6e149b86406225e3aca99e9bbae44cf13c0c7d5e10be27155162b63832f2f On require'bnpl-forms-test-utils', index.js loads platform.js, which selects a platform-specific endpoint and downloads an opaque binary via https.ge...

Malicious code in bnpl-blocks-types-gen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de78304bd1becbc9d7c967d281a308b18da039554be722990596f528180454f5 On require'bnpl-blocks-types-gen', top-level code in index.js invokes setup in platform.js, which selects a platform-specific binary path, downloads...

MAL-2026-13021 Malicious code in bnpl-blocks-types-gen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de78304bd1becbc9d7c967d281a308b18da039554be722990596f528180454f5 On require'bnpl-blocks-types-gen', top-level code in index.js invokes setup in platform.js, which selects a platform-specific binary path, downloads...

Malicious code in bnpl-molecule-mobile-bnpl-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf9828096a3c18e00ad577689ebcf4e4fa304a8702db4a0993063c95182530e On require of the package, index.js loads adapter.js, which runs an asynchronous dropper: it selects a platform-specific asset, downloads an executab...

MAL-2026-13043 Malicious code in boxy-expander-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1f5856de3b0385535e80e5ef85627ecb7a087132c82c5d5457b35b62b9eaf72 On require of this package, index.js loads./runtime.js which assembles Cloudflare Workers hostnames via string-split.join'' fragments e.g...

Malicious code in boxy-fixture-sb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 569ec5c3f70be02f417bbbe5694a31d6c7d48dadfcacc2500455fffb5ff23d07 On require of boxy-fixture-sb, index.js loads compat.js which reconstructs Cloudflare Workers hostnames from string-split arrays joined at runtime to...

MAL-2026-13048 Malicious code in boxy-fixture-sb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 569ec5c3f70be02f417bbbe5694a31d6c7d48dadfcacc2500455fffb5ff23d07 On require of boxy-fixture-sb, index.js loads compat.js which reconstructs Cloudflare Workers hostnames from string-split arrays joined at runtime to...

Malicious code in boxy-demo-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4fef0cd8b9f91923e6bf6bf357c229e57bb3b108b48ddc3bc9f0faa8f16b8db On require, index.js loads bridge.js which fetches a platform-specific executable from Cloudflare Workers subdomains whose hostnames are reassembled...

MAL-2026-13037 Malicious code in boxy-demo-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4fef0cd8b9f91923e6bf6bf357c229e57bb3b108b48ddc3bc9f0faa8f16b8db On require, index.js loads bridge.js which fetches a platform-specific executable from Cloudflare Workers subdomains whose hostnames are reassembled...

Malicious code in boxy-esm-shims (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8f8bbecdfed31ec416782f6de127cb1003692978560504d748acd121b30fa3b On require of the package, index.js loads vendor.js which fetches an opaque binary from string-obfuscated Cloudflare Workers hosts...

MAL-2026-13042 Malicious code in boxy-esm-shims (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8f8bbecdfed31ec416782f6de127cb1003692978560504d748acd121b30fa3b On require of the package, index.js loads vendor.js which fetches an opaque binary from string-obfuscated Cloudflare Workers hosts...

Malicious code in boxy-fixture (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb575dd1ac71dc5968106b313680bb84dd0d90172e82c1a79887b085ba55b4bd On require of the package, index.js loads support.js which executes setup at module load. The code reconstructs Cloudflare Workers hostnames...

Malicious code in boxy-fixture-paperclip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78a47f722fb30af7936e07182fa5fb42ecfd7efbacadd970a148a8a7daefc8e2 On any require/import, index.js loads adapter.js, which selects a platform-specific asset and downloads an opaque binary from a rotating set of...

MAL-2026-13045 Malicious code in boxy-fixture-paperclip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78a47f722fb30af7936e07182fa5fb42ecfd7efbacadd970a148a8a7daefc8e2 On any require/import, index.js loads adapter.js, which selects a platform-specific asset and downloads an opaque binary from a rotating set of...

Malicious code in boxy-get-retry-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bd36db17d5636ee0cd74be0ca5d35fc190e75749360c297ecd52821d74ab8b8 On require, index.js delegates to helpers.js which selects a platform-specific asset path, downloads an opaque binary over HTTPS from obfuscated...

MAL-2026-13049 Malicious code in boxy-get-retry-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bd36db17d5636ee0cd74be0ca5d35fc190e75749360c297ecd52821d74ab8b8 On require, index.js delegates to helpers.js which selects a platform-specific asset path, downloads an opaque binary over HTTPS from obfuscated...

Malicious code in boxy-lcd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c7174f43951c87b6b7ffb67430170a9b655978a1fe64654729c87fe35ced60 The package's index.js top-level requires setup.js, which on load fetches an OS-specific executable from string-concat-obfuscated Cloudflare Workers...