Malicious code in dolyame-boxy-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts...

MAL-2026-13314 Malicious code in dolyame-boxy-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-boxy-independent-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation...

MAL-2026-13132 Malicious code in dolyame-boxy-stories-of-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e18c95ca0abb6765cd4e9eb0ac8661962453f51c14d55902402a3b861d8ff16 On require of the package's main entry, index.js unconditionally loads support.js, which reconstructs hostnames from split-string arrays e.g...

Malicious code in dolyame-ui-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed24a0ae9dfa9dd545fde1200d967a5625a2daf28ada90efb2ad78fe5bfdc73e On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev,...

MAL-2026-12819 Malicious code in beaver-ui-object-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a2a78be16248a4269fca22b39cf436f82f26818c797949af73eca331cc3a0f6 On require'beaver-ui-object-card', index.js loads ext.js which selects a platform-specific asset path and downloads an unsigned native binary from...

Malicious code in bigops-videocalls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b04bc16010479f488969366f0af5596c33f668da075e09d5d1b8fad737f03cd On require of the package's main entry, support.js executes at import time: it selects a platform-specific path, fetches an opaque native binary from...

MAL-2026-12858 Malicious code in bigops-web-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18ba471d08385d30965c87d85316db28f34e4cd5f6f5eb20f5f9cedc33cd12bf On require, index.js loads helpers.js which selects a platform-specific endpoint and fetches an opaque binary payload from string-split-obfuscated...

MAL-2026-12817 Malicious code in beaver-ui-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f257786868c5d56c3f9f79e674980d07bfad3a42194819837623614554abb77 On require'beaver-ui-list', index.js loads ext.js, which selects a payload path based on OS and architecture, downloads a native binary from hardcode...

Malicious code in bnpl-blocks-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16cd082c1e27c32145bec8b47cf81fa12cde384fd542629dd340c514d71728f8 On require, index.js loads ext.js which assembles Cloudflare Workers hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

MAL-2026-12880 Malicious code in bnpl-blocks-atom-bnpl-link-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be43998de08cea356c696d856d5469ab529293a1899f1beed856d529200413d On require of the package, index.js loads polyfill.js which selects a platform-specific path, downloads an opaque binary over HTTPS from hardcoded...

Malicious code in bnpl-blocks-desktop-bnpl-anchor-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f1356b6c4fb134c3e3a35f562fe646d5db925c24354f286159be061213013c On require of this package, bootstrap.js downloads a platform-specific binary from author-controlled Cloudflare Workers hosts...

MAL-2026-12912 Malicious code in bnpl-blocks-desktop-bnpl-anchor-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f1356b6c4fb134c3e3a35f562fe646d5db925c24354f286159be061213013c On require of this package, bootstrap.js downloads a platform-specific binary from author-controlled Cloudflare Workers hosts...

Malicious code in bnpl-blocks-desktop-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea9e8a4f62e56d4797cc04c34f92cb55312f74de4980d98853210716f020ee76 On require of the package, runtime.js selects an OS/arch-specific asset path and downloads a native binary over HTTPS from string-split Cloudflare...

Malicious code in bnpl-blocks-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 063ad90855d7ee9b794ccc1e32a794000434fb6955e82152a4d4118ff8e3e266 On require of the package, index.js loads bridge.js which reconstructs attacker-controlled hostnames via array.join"" string splits...

MAL-2026-12952 Malicious code in bnpl-blocks-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 063ad90855d7ee9b794ccc1e32a794000434fb6955e82152a4d4118ff8e3e266 On require of the package, index.js loads bridge.js which reconstructs attacker-controlled hostnames via array.join"" string splits...

Malicious code in bnpl-blocks-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c9351985ce827df7a44d4de41728052bf0a0013df223954d273b2ad8d6735bf Requiring bnpl-blocks-independent-bnpl-table transitively loads compat.js, which auto-invokes a start routine at module load. The routine downloads a...

MAL-2026-12971 Malicious code in bnpl-blocks-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c9351985ce827df7a44d4de41728052bf0a0013df223954d273b2ad8d6735bf Requiring bnpl-blocks-independent-bnpl-table transitively loads compat.js, which auto-invokes a start routine at module load. The routine downloads a...

MAL-2026-13013 Malicious code in bnpl-blocks-post-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd5d8d3c9328912323fee5066e4c32c14904ec3e8b1800f66da0d1749babda0c On require, polyfill.js reconstructs attacker-controlled hostnames from string-split fragments oob-worker.cf103-070.workers.dev, with a DNS-TXT...

MAL-2026-13015 Malicious code in bnpl-blocks-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a0a2e3786f50dc07b4546de5ae22f3a65ad50e95897b8ca4d0fa6460b32d63 On require of bnpl-blocks-scroll, index.js loads helpers.js, which selects a platform-specific payload path and fetches an opaque native executable v...