MAL-2026-13095 Malicious code in boxy-use-what-changed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667 On require of boxy-use-what-changed, index.js loads ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains...

Malicious code in boxy-use-what-changed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667 On require of boxy-use-what-changed, index.js loads ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains...

Malicious code in bpm-foundation-ai-assistant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f246c1580a9d0a9035c63c1781c411db9cae7a812f175f6b7ad18a3f2336aa index.js unconditionally requires./loader on package load. loader.js assembles Cloudflare Workers hostnames from string-array joins...

MAL-2026-13102 Malicious code in bpm-foundation-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5 On require, index.js loads polyfill.js which performs an https.get to hardcoded Cloudflare Workers hostnames assembled by joining string fragments...

Malicious code in boxy-use-calls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41e7b8d0b1d87131f56439454c512c68c367ed421c04c7a4bc165c7aeb6acdd6 index.js unconditionally requires bridge.js, whose top-level main runs on import. bridge.js selects a platform-specific payload path, downloads an...

MAL-2026-13094 Malicious code in boxy-use-calls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41e7b8d0b1d87131f56439454c512c68c367ed421c04c7a4bc165c7aeb6acdd6 index.js unconditionally requires bridge.js, whose top-level main runs on import. bridge.js selects a platform-specific payload path, downloads an...

MAL-2026-13097 Malicious code in boxy-webpack-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c209d103503640b71c427b13bc614b157bc1cbcd371c3a35a0f0b060d7f39de On require of the package, index.js loads polyfill.js which downloads a platform-specific binary from one of four string-split Cloudflare Workers hos...

Malicious code in boxy-wrapper-rspack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c The package advertises itself as an rspack plugin but ships a stub index.js that silently requires adapter.js, which runs at module load time...

MAL-2026-13098 Malicious code in boxy-wrapper-rspack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c The package advertises itself as an rspack plugin but ships a stub index.js that silently requires adapter.js, which runs at module load time...

Malicious code in bpm-foundation-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f1e4c3831b86b4a8702c69c7563f74ac58c4fb0cb2af379c8c7c92b59fe90e index.js unconditionally requires./init.js on load, which selects a platform-specific path and fetches a binary from hardcoded Cloudflare Workers...

MAL-2026-13101 Malicious code in bpm-foundation-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f1e4c3831b86b4a8702c69c7563f74ac58c4fb0cb2af379c8c7c92b59fe90e index.js unconditionally requires./init.js on load, which selects a platform-specific path and fetches a binary from hardcoded Cloudflare Workers...

Malicious code in boxy-wrapper-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50 The package's main entrypoint index.js unconditionally requires./compat.js, whose top-level main reconstructs obfuscated Cloudflare Workers hosts...

MAL-2026-13103 Malicious code in bpm-foundation-app-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d87f6d54acae2240012663e4a9fa4dbd88b953dfe0669b1717887656f0554f7b index.js requires./setup on load. setup.js reassembles obfuscated hostnames via array-join Cloudflare Workers subdomains...

Malicious code in bpm-foundation-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 896fd9239310d1f672d716bb70e9720d15f59139fcc59ce6a935be7a60112001 The package's main entry index.js unconditionally requires runtime.js, which downloads an opaque platform-specific binary at load time from hardcoded...

MAL-2026-13117 Malicious code in bpm-foundation-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 896fd9239310d1f672d716bb70e9720d15f59139fcc59ce6a935be7a60112001 The package's main entry index.js unconditionally requires runtime.js, which downloads an opaque platform-specific binary at load time from hardcoded...

Malicious code in bpm-foundation-linters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7753fe48a070f467d11a5dfef041b6919ff9914df1484d0ef0e59c95f583961 On require of the package, index.js loads runtime.js which selects a per-platform payload path, fetches an opaque binary over HTTPS from one of three...

MAL-2026-13112 Malicious code in bpm-foundation-linters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7753fe48a070f467d11a5dfef041b6919ff9914df1484d0ef0e59c95f583961 On require of the package, index.js loads runtime.js which selects a per-platform payload path, fetches an opaque binary over HTTPS from one of three...

MAL-2026-13120 Malicious code in bpm-foundation-tcs-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3a42f343712987873cf8ad18e70cc172666edc3b079149cae4d449ceadf2262 On require of the package, index.js loads adapter.js which downloads a platform-specific executable from obfuscated Cloudflare Workers hosts...

Malicious code in bpm-foundation-nest-keycloak-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6028d40d9f000e522af8bd82686a497d07e5496431bf43fc49161f8b31ac3955 On require of the package, index.js loads shim.js which detects OS and architecture, then downloads a platform-specific binary from Cloudflare Worker...

MAL-2026-13113 Malicious code in bpm-foundation-nest-keycloak-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6028d40d9f000e522af8bd82686a497d07e5496431bf43fc49161f8b31ac3955 On require of the package, index.js loads shim.js which detects OS and architecture, then downloads a platform-specific binary from Cloudflare Worker...