Malicious code in bigops-offers (npm)

Source: amazon-inspector 422359e6c8044efa7c3873ff0859acb1480ea95413cbfb8829dc4c674de6f8d5 [email protected] executes a binary dropper at require time. index.js loads./init on import; init.js assembles C2 hostnames from split string arrays workers.dev subdomains oob-worker.cf100-416.workers.dev...

Malicious code in bigops-notes (npm)

Source: amazon-inspector 51b318f6ad8ba92430c504fd94111609cc003a62f8bce36e3c1f41308b195dae On require of bigops-notes, bootstrap.js selects a platform-specific asset, downloads an opaque binary from one of four runtime-assembled .workers.dev hostnames oob-worker.cf103-070.workers.dev,...

Malicious code in dolyame-ui-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c1280f596630bc692c2587a15a33bd01b2b745875cfe8a590e6787757867dd On require of dolyame-ui-badge, the package loads bootstrap.js which downloads a native binary from runtime-assembled Cloudflare Workers hosts...

MAL-2026-12647 Malicious code in claims-use-callback-once (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d807b141b53b48d7c3c104e9beb4904187499f289b79c1eda8f0bc91f8a1 On require of claims-use-callback-once, index.js unconditionally loads shim.js which selects a platform-specific payload path, fetches an executable...

Malicious code in delivery-ci-tech-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63eae2afeb5a45d70f1d217049ab813392464cc8fb099462c716b8573836ed6b On require of the package, index.js loads support.js, which reconstructs hardcoded destinations from split string arrays...