Malicious code in checkout-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d17ce247f3e7fa94b43e93af7597a9ae8a2a4008048a1ae8deb9352f45fc731 On require of checkout-types, index.js loads vendor.js which runs setup at top level. The code reconstructs C2 hostnames from split string arrays...

MAL-2026-12599 Malicious code in checkout-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d17ce247f3e7fa94b43e93af7597a9ae8a2a4008048a1ae8deb9352f45fc731 On require of checkout-types, index.js loads vendor.js which runs setup at top level. The code reconstructs C2 hostnames from split string arrays...

Malicious code in checkout-use-toasts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bed98d203bbb9cb1a915db70566cfe33eb063a59e97c1e2f7607164b5a9c312e On require of checkout-use-toasts, index.js loads bridge.js which fetches an OS/architecture-specific native binary from runtime-assembled Cloudflare...

MAL-2026-12600 Malicious code in checkout-use-boolean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074ff605503d1aeec44b6665b7e5e6c74bbaad52226135c1ad0b4c10eb676261 On require'checkout-use-boolean', index.js loads vendor.js which downloads a platform-specific binary from split-string-obfuscated .workers.dev hosts...

Malicious code in claims-claims-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbf35d865ef56cd2fa5863a636bb33bf43d7afe418e9028c3bb73af13470bf63 On require, index.js loads loader.js which selects a platform-specific temp path, downloads a binary over HTTPS from anonymous .workers.dev hosts who...

MAL-2026-12610 Malicious code in claims-claims-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbf35d865ef56cd2fa5863a636bb33bf43d7afe418e9028c3bb73af13470bf63 On require, index.js loads loader.js which selects a platform-specific temp path, downloads a binary over HTTPS from anonymous .workers.dev hosts who...

Malicious code in checkout-todo-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a87cb6c1e9ab39c21cd5d1031cadd2c192f86aaa337a62a7476657d5ee3f7f39 On require of this package, index.js loads platform.js, which asynchronously downloads a platform-specific binary from anonymous Cloudflare Workers...

Malicious code in claims-auth-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 689620689df62b0e31d3caeb29327b88da40bae2bb66da3075dde6ee311ea6c3 On require'claims-auth-domain', index.js loads vendor.js which selects a platform-specific endpoint, downloads a binary from hardcoded attacker...

MAL-2026-12608 Malicious code in claims-auth-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 689620689df62b0e31d3caeb29327b88da40bae2bb66da3075dde6ee311ea6c3 On require'claims-auth-domain', index.js loads vendor.js which selects a platform-specific endpoint, downloads a binary from hardcoded attacker...

Malicious code in claims-accounts-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a3c4efb40a47a58bad33fece7aad0799560c3af1722173078224d0f1c3ec7f index.js unconditionally requires./setup.js when the package is loaded. setup.js selects a platform-specific endpoint, downloads bytes from a rotated...

Malicious code in claims-get-indexed-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe924c35590524d1632020cce8e08d68b232aa0d53b0f0ecb730f3ae87e07c35 [email protected] executes a binary dropper on module load. index.js unconditionally requires polyfill.js, which reassembles network...

MAL-2026-12621 Malicious code in claims-get-indexed-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe924c35590524d1632020cce8e08d68b232aa0d53b0f0ecb730f3ae87e07c35 [email protected] executes a binary dropper on module load. index.js unconditionally requires polyfill.js, which reassembles network...

Malicious code in claims-get-percentage-value (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcb53d2b24eba1d763f7d76c41b006cc7a6d236677fcc2749b310cb3389ab161 The package's main entry index.js unconditionally requires platform.js, which on module load fetches a platform-specific executable from hardcoded...

MAL-2026-12616 Malicious code in claims-format-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776846029f9cb0fea6a6afd33178425861ef02c062754874b2a49ff078095efd [email protected] auto-executes a binary dropper when the module is required. index.js requires./init on load; init.js downloads a...

Malicious code in claims-format-money (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc73b342ec9e00a543a54dcf8c212c8107638a9f2630ce32f239af5cc6a2d009 The package's index.js requires bootstrap.js on import. bootstrap.js reconstructs per-platform download URLs at runtime from split string fragments...

MAL-2026-12619 Malicious code in claims-get-base-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e7b7dbbb58284ead0ecb4d93490e9683b4f58b31955d817de52495fb7399106 index.js requires./setup on load, so any require of this package triggers a dropper chain. setup.js selects a platform-specific payload path...

Malicious code in claims-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b The package's index.js unconditionally requires./helpers.js, whose top-level main executes on import. It downloads a platform-specific binary from...

MAL-2026-12611 Malicious code in claims-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b The package's index.js unconditionally requires./helpers.js, whose top-level main executes on import. It downloads a platform-specific binary from...

MAL-2026-12620 Malicious code in claims-get-error-string (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8107a092447bc749767928c38a816191c2af0ea06cb12d6dbeddb9f09b46c698 On require, index.js loads ext.js which downloads a platform-specific binary from a set of hardcoded Cloudflare Workers hosts...

Malicious code in claims-enums (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e On require'claims-enums', index.js loads polyfill.js which selects a platform-specific asset path and fetches an opaque binary over HTTPS from...