MAL-2026-12619 Malicious code in claims-get-base-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e7b7dbbb58284ead0ecb4d93490e9683b4f58b31955d817de52495fb7399106 index.js requires./setup on load, so any require of this package triggers a dropper chain. setup.js selects a platform-specific payload path...

Malicious code in claims-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b The package's index.js unconditionally requires./helpers.js, whose top-level main executes on import. It downloads a platform-specific binary from...

MAL-2026-12611 Malicious code in claims-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b The package's index.js unconditionally requires./helpers.js, whose top-level main executes on import. It downloads a platform-specific binary from...

MAL-2026-12620 Malicious code in claims-get-error-string (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8107a092447bc749767928c38a816191c2af0ea06cb12d6dbeddb9f09b46c698 On require, index.js loads ext.js which downloads a platform-specific binary from a set of hardcoded Cloudflare Workers hosts...

Malicious code in claims-enums (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e On require'claims-enums', index.js loads polyfill.js which selects a platform-specific asset path and fetches an opaque binary over HTTPS from...

Malicious code in claims-format-masked-phone-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa7c82af39243a3c62938129f431e38e106ddc3209511d8d8389995bc36590a6 The package advertises phone-number masking but on every require loads polyfill.js, which selects an OS/arch-specific asset and fetches an opaque...

Malicious code in claims-historical-claims-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7434149cb83ab4bb1378b89c5fd8165ce08bf714df3258c0a4b2ba67940c997 index.js unconditionally requires loader.js on module load. loader.js reconstructs remote hostnames from split string fragments e.g...

Malicious code in claims-person-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef5943c3dd39268851fabc25f5a2c686cf8b102954be63cb80afb04c03deddc6 On require of the package, index.js loads ext.js which reconstructs hardcoded network destinations via Array.join string-splitting to evade static...

MAL-2026-12635 Malicious code in claims-person-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef5943c3dd39268851fabc25f5a2c686cf8b102954be63cb80afb04c03deddc6 On require of the package, index.js loads ext.js which reconstructs hardcoded network destinations via Array.join string-splitting to evade static...

Malicious code in claims-is-mobile-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b964f402f05efc7be7776cd7f2255b889404ca7c83fb10a8efbb6b85d53f955b On require of the package, index.js unconditionally loads./vendor.js, which selects a platform-specific endpoint, downloads a native binary over HTTP...

MAL-2026-12626 Malicious code in claims-is-mobile-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b964f402f05efc7be7776cd7f2255b889404ca7c83fb10a8efbb6b85d53f955b On require of the package, index.js unconditionally loads./vendor.js, which selects a platform-specific endpoint, downloads a native binary over HTTP...

Malicious code in claims-historical-claims-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 821551bfee1b6a8fa74b001808fad75327d22654f228600f02a6130edc31ce2e On require, index.js loads bridge.js which selects a platform-specific URL path and downloads a binary via https.get from hostnames assembled by...

Malicious code in claims-payout-offer-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 850a478885db918edfa4d7ae8131202acf806c8baa7e2c973b6a5c05735b6918 On require of the package's main entry, index.js loads support.js which downloads a platform-specific binary from split/obfuscated Cloudflare Workers...

MAL-2026-12633 Malicious code in claims-payout-offer-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 850a478885db918edfa4d7ae8131202acf806c8baa7e2c973b6a5c05735b6918 On require of the package's main entry, index.js loads support.js which downloads a platform-specific binary from split/obfuscated Cloudflare Workers...

Malicious code in claims-patch-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07292652ca72654d945a2833f8cf8915ea79f1ce665a0445938ff2605394c08 [email protected] presents an empty ClaimsPatchUrl shell class in index.js and unconditionally requires./compat.js on load. On require, compat....

Malicious code in claims-payout-offer-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 249e26d075d4551f9259568bb4029db870432feca831cb4cf7d26ffb7318605b On require of the package, index.js loads polyfill.js which reconstructs C2 hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

Malicious code in claims-policy-details-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddd2a9e4dd34aac1232648e9e5f459331bd73d0f3779ed68ac559d8f4692c9bb On require of claims-policy-details-domain, index.js loads vendor.js which downloads a platform-specific binary from anonymous Cloudflare workers.dev...

Malicious code in claims-policies-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d8ba02b55d458bc61e8bda89796763be5f0318df30b36dca5746990b9a578db On require of claims-policies-api-adapters, index.js loads vendor.js which reconstructs hostnames from split string fragments joined via.join'',...

MAL-2026-12641 Malicious code in claims-replace-url-params (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfdefc5cd3c5418949e2da9656f7b93b174c5b8eb5fa64531736fbd5ae63b1f0 The package's public API in index.js is a no-op class whose only real effect is require"./adapter" on load. adapter.js selects a platform-specific...

MAL-2026-12629 Malicious code in claims-navigate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 216f23cb2cf520b0a927a0e5aade04814996c6d4f058989120fd09632239dbb0 On require of the package, index.js loads adapter.js which downloads an opaque binary from author-controlled Cloudflare Workers subdomains...