MAL-2026-13557 Malicious code in dolyame-ui-checkablegroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js...

MAL-2026-13231 Malicious code in bigops-outgoing-call (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 536ee260eadf72447df4e01eb549a86779846d21b3b9b539b486f2bcd65ba750 On require of index.js the package loads runtime.js, which selects a platform-specific asset path and fetches an opaque binary from one of four...

Malicious code in dolyame-ui-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15f91ac3c4278628875a5c009c515bcdb5fbc8b885eb32dff56e4367c5babf66 On require, index.js loads bootstrap.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints hostnames assembled at...

MAL-2026-13168 Malicious code in dolyame-ui-mixins (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c202a6c0c4fddf77f53b3fc786c34627b47992e1f789701121793399dce47ebd On require of dolyame-ui-mixins, index.js loads./ext, which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32 and downloads ...

MAL-2026-12900 Malicious code in bnpl-blocks-atom-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0bf90f9ba8f401c6300846c2e5fa3af2afd241fba5d967300272a8dc7eadec7 On require of bnpl-blocks-atom-container, index.js loads adapter.js which selects a platform-specific target path, downloads an opaque binary from on...

MAL-2026-12626 Malicious code in claims-is-mobile-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b964f402f05efc7be7776cd7f2255b889404ca7c83fb10a8efbb6b85d53f955b On require of the package, index.js unconditionally loads./vendor.js, which selects a platform-specific endpoint, downloads a native binary over HTTP...

Malicious code in tcb-web-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115bda849ee7aff33e1ccc649f492e892e31243bfb026eea8048c158c885bdf0 On require of tcb-web-header, platform.js selects an OS/arch-specific endpoint, downloads a binary from Cloudflare workers.dev hosts whose names are...

MAL-2026-12352 Malicious code in checkout-mobile-pay-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3299d3b20175ec3cd68c2355ccafd1e969237d93b2e708c92a9913ff323b19be [email protected] is a lure package: its name and README describe a 'mobile pay button platform adapter', but index.js unconditionall...