MAL-2026-13559 Malicious code in dolyame-ui-collapseblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

MAL-2026-13283 Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

Malicious code in dolyame-boxy-atom-desktop-bnpl-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b63e38f9a4be0ffccf426124ce23e7d5c0ddfde68cc81ad44cbfe75ef22c31c The package's index.js silently loads loader.js via a swallowed try/catch try require'./loader'; catch . loader.js assembles one of three Cloudflare...

MAL-2026-13305 Malicious code in dolyame-boxy-desktop-bnpl-hero-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 036c11daa7712014748d57bc2bca8a37672acffa8f3eaca83161b726ba473fdb On require of the package, helpers.js reassembles hostnames from split string arrays e.g. 'oob-worker.cf102-baf.workers.dev',...

MAL-2026-13315 Malicious code in dolyame-boxy-independent-bnpl-code-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7222a6cf31e1412fd943bcf3b140b02f6c615b1650f9c39cabf813801557ae On require of the package, index.js loads ext.js which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers hosts...

MAL-2026-12826 Malicious code in beaver-ui-storybook-addon-code-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8105d085fbf1a6ec1018ac850555ec02e022725ce198f54ac291133b847d9db On require of the package main, loader.js selects an OS-specific endpoint, downloads a binary via https.get from one of several hardcoded Cloudflare...

Malicious code in devplatform-http-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0232efebd49d07216da6eabd594c614076a3d1b414417d0d1be86d547a9c1adc On require of devplatform-http-client, index.js loads vendor.js which unconditionally invokes init. The routine selects a platform-specific payload...

MAL-2026-12712 Malicious code in devplatform-http-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0232efebd49d07216da6eabd594c614076a3d1b414417d0d1be86d547a9c1adc On require of devplatform-http-client, index.js loads vendor.js which unconditionally invokes init. The routine selects a platform-specific payload...

Malicious code in pfp-forms-mobile-sme-group-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a17b2afbbc0ab147312c16ab39ed32f31061c185ff2dedbea76bdf5940dd2a On require, polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several .workers.dev hosts whose names ar...

Malicious code in dolyame-boxy-atom-bnpl-email-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9cb745c0771868eb6908cf1c783614da3e41fe1d1cf52b4d2d04705c51af19 On require of the package's main, index.js side-loads runtime.js which selects a per-platform payload path, fetches an opaque binary from string-spli...

MAL-2026-12212 Malicious code in statist-browser-typed-client-mb.product.payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61ded83f5a0c3472f0519b9c807345fa6d92458f26cbffa730831da19cfea843 On require of the package, index.js loads bootstrap.js which selects a platform-specific asset, downloads an opaque native binary from Cloudflare...

Malicious code in hubert-application-get-document-preview-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e887ef3c3509ebfe43d231ff354e4e0d7f8eb20c9da05389324446d44fc589 On require of the package, index.js loads setup.js which selects a platform key, downloads a native binary from one of four hardcoded workers.dev...