Malicious code in dolyame-ui-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 237fff59f0e3f9c92ab2644c3ec861289c7132a613b7886e41820b2a04054d38 On require of the package, helpers.js downloads a platform-specific binary from hardcoded Cloudflare Workers mirrors oob-worker.cf99-9b3.workers.dev,...

Malicious code in bpm-foundation-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731f1d13e5958a2b7954d0c472f56bae0663ebc6e0d0e1f2e7c080b70f124c73 index.js unconditionally requires./platform on load. platform.js selects a per-OS payload path, fetches bytes from one of three...

Malicious code in claims-payout-offer-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7e5ae73b4b2f79e2790e4c9f503a3f469166c8d5587f7e84ac6a09022d1617f On require of the package, index.js unconditionally loads vendor.js, which selects an OS/arch-specific payload path and fetches an opaque binary over...

Malicious code in cobrowsing-redis-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c907b28a2866d4fc67be93a6417e535336938ce3e8c23f0f95e927c6711b6 index.js unconditionally requires./loader on import. loader.js selects a platform-specific endpoint, assembles C2 hostnames at runtime from split...

MAL-2026-12742 Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

MAL-2026-12171 Malicious code in bigops-informer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 324bb851ecf14c623080e07471bd23a7ea505bc6db244c654895a1cce71bf7e8 On require, index.js loads bootstrap.js which reconstructs a set of destination hostnames from string-array joins resolving to...

MAL-2026-12074 Malicious code in statist-browser-typed-client-nfs.grocery.mobile.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fcb1561dd1153104da17218a74c318e8d497b4df1429bbbda8cda0144bd06ce On require of the package's main entry, index.js transitively loads platform.js, which selects a platform-specific payload URL, fetches opaque...