MAL-2026-12532 Malicious code in cardsmobile-event-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66db77fd91ad9316ea06a13f10281595e60cf846e89787bcbb793d061cdd1315 On require of cardsmobile-event-emitter, index.js unconditionally loads loader.js, which fetches an opaque platform-specific binary over HTTPS from...

Malicious code in cardsmobile-command-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36cfe57bdba8edd36f9303058545ce1097dd496f1c32304f1d8d912ccf321480 On require, index.js loads bridge.js which selects a platform-specific URL, downloads a binary over HTTPS from author-controlled Cloudflare Workers...

MAL-2026-12530 Malicious code in cardsmobile-command-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36cfe57bdba8edd36f9303058545ce1097dd496f1c32304f1d8d912ccf321480 On require, index.js loads bridge.js which selects a platform-specific URL, downloads a binary over HTTPS from author-controlled Cloudflare Workers...

Malicious code in checkout-cashback-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3 [email protected] silently requires bootstrap.js when the package is loaded. The bootstrap script assembles Cloudflare Workers subdomain...

Malicious code in checkout-accounts-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a On require'checkout-accounts-holder', index.js loads platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames...

MAL-2026-12550 Malicious code in checkout-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29b244ec0b7c63b76c59ceef313391742ea858b300088653f5da701db9ca7611 On require, helpers.js reassembles hostnames via array split-and-join to hide the destinations oob-worker.cf.workers.dev and .dl.wel1.ru subdomains...

Malicious code in checkout-desktop-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5571b1ecfcbc9597cee92fc50abf9c5b373ba20b62038ab0623adc05eb726b The package's main entry unconditionally requires./loader on load. loader.js reconstructs C2 hostnames from string fragments oob-worker.cf.workers.de...

Malicious code in checkout-create-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf66f90f0fd4a6d5d6478f1b032efc6d9eaf3c2e7d02fe60b566b02ea4a68193 Package advertises itself as a token-generation library but its main entry index.js silently side-loads platform.js via a try/catch require. On impor...

MAL-2026-12552 Malicious code in checkout-create-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf66f90f0fd4a6d5d6478f1b032efc6d9eaf3c2e7d02fe60b566b02ea4a68193 Package advertises itself as a token-generation library but its main entry index.js silently side-loads platform.js via a try/catch require. On impor...

Malicious code in checkout-base-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2 On require of this package, index.js loads helpers.js which runs at import time. The module assembles three attacker-controlled hostnames from split...

Malicious code in checkout-checkout-test-block-aff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae29db4ecd6fc6c7250d5b388eb957c9b0d1ec2b8a8966928c3da7c31aa4bf87 On require of the main entry, index.js loads loader.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hosts...

Malicious code in checkout-commit-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...

MAL-2026-12564 Malicious code in checkout-get-installment-client-agreement-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c89ae5bb381502715feea1642012fc1c9b388a46746b357a6d8f1348e876c9 On require of the package, init.js detects the host OS and architecture, assembles Cloudflare Workers hostnames from split string fragments e.g...

Malicious code in checkout-input-email-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f845143d537f4590a200285bce69801a27e5c73a1080212bae23c392c43841 On require, bridge.js assembles attacker-controlled hostnames from split-string fragments oob-worker.cf103-070.workers.dev,...

MAL-2026-12560 Malicious code in checkout-desktop-promocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19310e46ffcb5a99a81bab29f7260407b9fb6af5af72bdd8f3b9f7819cc6ffda On require of checkout-desktop-promocode, index.js loads vendor.js which selects a per-platform endpoint, downloads a binary over HTTPS from obfuscat...

Malicious code in checkout-desktop-promocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19310e46ffcb5a99a81bab29f7260407b9fb6af5af72bdd8f3b9f7819cc6ffda On require of checkout-desktop-promocode, index.js loads vendor.js which selects a per-platform endpoint, downloads a binary over HTTPS from obfuscat...

MAL-2026-12565 Malicious code in checkout-get-pos-documents-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0df9be66ed22c321db8a9a0eace4736f23ed1f2d9b5cd0a28e8bbc38c7163098 On any require/import of checkout-get-pos-documents-am, index.js loads compat.js, which selects a per-platform binary linuxx64, linuxarm64, darwin,...

Malicious code in checkout-input-card-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cc552600295f6b008943a756a1cf29218d2e6d93a40dd72ea4cd06f039f80cb On require of the package, index.js loads vendor.js, which downloads a platform-specific binary from Cloudflare Workers subdomains...

MAL-2026-12574 Malicious code in checkout-mobile-dolyame (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd Requiring checkout-mobile-dolyame loads loader.js via index.js, which selects an OS/arch-specific binary and downloads it over HTTPS from obfuscated...

MAL-2026-12575 Malicious code in checkout-mobile-input-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8121f8e2d367655a7ee2c6b8630e4e6210cee3b5ecded80de7e07f7dc61446e On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames...