Malicious code in sme-rko-finance-front-payments-feed-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05877cb287448f82b3b8a223454971cbd881ff8667e597472c04123697295220 The package is advertised as a finance/payments adapter but on require reaches a staged loader. adapter.js reconstructs destination hostnames from...

MAL-2026-13641 Malicious code in sme-rko-finance-front-operations-notifications-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1d9ca70f719a1aa76a11ce147945ee7acefdb72bcbf955d1c7cd30a5d9f85e8 On require of the package, index.js side-effect loads polyfill.js and lib/telemetry.js, both of which act as native-binary droppers. Hostnames and...

MAL-2026-13496 Malicious code in ded-pwa-c-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b On require'ded-pwa-c-cms', index.js loads platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from...

Malicious code in checkout-subscription-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7a62aaa04f6806d8ad86f8c9baaaddde733815a4d2f51bc3db803bf30998f4c On require of the package, index.js loads bootstrap.js inside a try/catch. bootstrap.js reconstructs its download hosts via array.join""...

Malicious code in checkout-promocode-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1d75e7966f60937203bdc9f6ee1a90e58fbf046f76ec5aa0b4d68018fce4f87 On require, index.js loads ext.js which selects a per-OS payload path, fetches an executable over HTTPS from string-concatenation-obfuscated hosts...

MAL-2026-12153 Malicious code in bigops-awesome-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1204820931e9021a079d3347320d6c127f68297ee6b0223b37967f6c2601f78 index.js unconditionally requires./loader on module load. loader.js reconstructs endpoint hostnames from split string arrays evading static matching,...