MAL-2026-13036 Malicious code in boxy-debugger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2 boxy-debugger 35.3.4 presents itself as a debugger library, but requiring the package triggers platform.js, which reconstructs attacker-controlled...

MAL-2026-13047 Malicious code in boxy-fixture-pfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a15e41a397b63d04216419ddd8ec88f37cb68c5d35997ad840543e034f87d8f On require of the package, polyfill.js downloads a platform-specific binary from hardcoded destinations reassembled at runtime from split-string arra...

MAL-2026-13064 Malicious code in boxy-maker-skeleton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06892152f894a88b72854f0773f64e68336cf6726fd0acc4b3d83c87f06301d3 On require of boxy-maker-skeleton, index.js loads compat.js which reconstructs destination hostnames by string-splitting/join to hide them from stati...

Malicious code in boxy-render-unwrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26755161d9a2ac85d670783fc7eb67383b08592dbb67899b916d3e521d560420 On require of boxy-render-unwrap, index.js loads bootstrap.js which selects a platform-specific payload URL from a set of obfuscated mirror hosts...

Malicious code in boxy-page-story (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cb3184221c24b500fca09d9e96c886b1ffe703d60b121150180b2387a87c48d On require, index.js loads./runtime, which reconstructs C2 hostnames from string-array concatenation to hide four...

Malicious code in boxy-sticky-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc08631cb79f90d5440020f420e9c7ad9e67ec84f25f085825c5b5f600f613a4 On require of the package, init.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at runtime from...

MAL-2026-13076 Malicious code in boxy-pkg-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae99d3d2f9b6c2a5a47e8edd34fb78968ffc58c3a514e04ad10b14455d7436f2 index.js unconditionally loads support.js on require. support.js reconstructs Cloudflare Workers hostnames oob-worker.cf100,1,2-.workers.dev and a.ru...

MAL-2026-13089 Malicious code in boxy-test-block-fixture (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b10e5c9aa6fedcb9d29f292cd6f5aa6634e770f46c6385a9fb32c0fc628ab27a On require/import of the package, init.js assembles attacker-controlled hostnames at runtime by joining split string fragments resolving to...

MAL-2026-13098 Malicious code in boxy-wrapper-rspack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c The package advertises itself as an rspack plugin but ships a stub index.js that silently requires adapter.js, which runs at module load time...

MAL-2026-13119 Malicious code in bpm-foundation-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1e2729c7a957ee4366b693a24d178137743df7bf2ee5d65d3cecf3c8cfdc5f On require, index.js loads ext.js, which selects a platform-specific path, fetches an executable over HTTPS from string-concatenation-obfuscated host...

Malicious code in bpm-foundation-renovate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a14b30ee8591115098467b468c9e7bb84ae57d52b7d7cdf36799e0a95f94a439 On require of the package, index.js loads helpers.js which selects a platform-specific endpoint, downloads a binary from a rotating list of Cloudflar...

MAL-2026-12515 Malicious code in bpm-foundation-test-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de196f443359e53af966cb2ca288d90e59e708c2cf7ad33ab2e0e20b7df2869e On require, index.js loads setup.js which assembles destination hostnames at runtime from split string fragments resolving to...

Malicious code in bpm-renovate-renovate-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b2fc5b92d1c0023e38459ab9285d928b6fbe3124bfda9d4d6b055dd1fe0bf4e On require, index.js loads setup.js which downloads a platform-specific binary over HTTPS from one of four string-concatenation-obfuscated .workers.d...

Malicious code in checkout-cashback-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3 [email protected] silently requires bootstrap.js when the package is loaded. The bootstrap script assembles Cloudflare Workers subdomain...

MAL-2026-12546 Malicious code in checkout-cashback-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3 [email protected] silently requires bootstrap.js when the package is loaded. The bootstrap script assembles Cloudflare Workers subdomain...

MAL-2026-12542 Malicious code in checkout-accounts-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b3edb78076f5105de32feda80276d41059215378d6ab90f2d11a332685c6a On require, the package loads adapter.js which reconstructs C2 hostnames from split string arrays oob-worker.cf99-9b3.workers.dev,...

Malicious code in checkout-checkout-test-block-aff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae29db4ecd6fc6c7250d5b388eb957c9b0d1ec2b8a8966928c3da7c31aa4bf87 On require of the main entry, index.js loads loader.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hosts...

MAL-2026-12549 Malicious code in checkout-confirm-pos-order-sms-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e On require of this package, index.js loads init.js which invokes init immediately. init downloads an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-12568 Malicious code in checkout-input-email-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f845143d537f4590a200285bce69801a27e5c73a1080212bae23c392c43841 On require, bridge.js assembles attacker-controlled hostnames from split-string fragments oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-input-email-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f845143d537f4590a200285bce69801a27e5c73a1080212bae23c392c43841 On require, bridge.js assembles attacker-controlled hostnames from split-string fragments oob-worker.cf103-070.workers.dev,...