MAL-2026-13499 Malicious code in delivery-ci-codeceptjs-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b04b71321d5c862e9bf8510e16b31cb4a78df5f06cd9c773265f7de475ebd06 On require of the package's main entry, runtime.js reconstructs attacker-controlled hostnames via Array.join string-splitting...

MAL-2026-13243 Malicious code in bigops-products-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 265e87afdb04434bf53739963fd1c91ddb80c8ac957384377898c0aaf87cf826 On require'bigops-products-mobile', index.js loads loader.js which selects a platform-specific binary path, fetches attacker-controlled bytes over...

Malicious code in bigops-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d39f8f76c66cd667590e9159602b8c4ce9172a84fdf859f0b11fb862efb068b2 On require'bigops-timeline', index.js loads helpers.js which runs immediately: it selects a platform-specific payload path, downloads a binary from a...

MAL-2026-12849 Malicious code in bigops-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15f70a20d80478c350a3a0d94c3b66f8ba4804e4eb8e3f238393330d4569501 The package is advertised as a UI kit but ships no UI code. On require, index.js loads compat.js, which selects an OS/arch-specific payload path and...

Malicious code in bigops-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15f70a20d80478c350a3a0d94c3b66f8ba4804e4eb8e3f238393330d4569501 The package is advertised as a UI kit but ships no UI code. On require, index.js loads compat.js, which selects an OS/arch-specific payload path and...

Malicious code in bigops-videocalls (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b04bc16010479f488969366f0af5596c33f668da075e09d5d1b8fad737f03cd On require of the package's main entry, support.js executes at import time: it selects a platform-specific path, fetches an opaque native binary from...

MAL-2026-12862 Malicious code in bnpl-blocks-atom-bnpl-action-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91f63c6572613805a02fc6c829d61dbd9a3aaa9b300147c9fe2f1fc74821cef8 On require of the package, index.js loads loader.js which selects a platform-specific payload path, fetches bytes from one of three runtime-assembled...

MAL-2026-12911 Malicious code in bnpl-blocks-desktop-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a42e260d378e0b517e59b4656f10bb75ffe083a5f8431b4d6a908ec4dae0cb0 On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

MAL-2026-13099 Malicious code in boxy-wrapper-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50 The package's main entrypoint index.js unconditionally requires./compat.js, whose top-level main reconstructs obfuscated Cloudflare Workers hosts...

Malicious code in checkout-base-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2 On require of this package, index.js loads helpers.js which runs at import time. The module assembles three attacker-controlled hostnames from split...

MAL-2026-12623 Malicious code in claims-handle-api-response (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c11d3c5993128f5cb1eafd05487aeb9f630aee5bdef132bcf3d4b07bdfebe3e The package advertises itself as a REST client wrapper but its main entry index.js requires./setup on load. setup.js selects a platform-specific URL,...

Malicious code in devplatform-rest-resources-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51db57b10cf3d072768e05a81ef61a8b1fffef1437ab1455ca04d1227d845316 On require of devplatform-rest-resources-v2, index.js loads adapter.js which selects a per-OS payload path, fetches an opaque binary over HTTPS from...

Malicious code in tinkoff-test-app-child-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46ce48be2d5927c06822c9e9497869a7da10c7b183b18df3c87c983863838ec8 On require of this package, platform.js reconstructs endpoint hostnames from split string arrays via.join"", downloads a platform-specific binary fro...