Malicious code in delivery-ci-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335 index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

Malicious code in devplatform-spa-plugin-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d61b9d430e59b37ce3c13873e37c1dd146d468b6a06f462761e2214acd1d0fa [email protected] executes attacker-controlled code on the installer's host at module import. The package's main entry loa...

MAL-2026-13573 Malicious code in dolyame-ui-inlineedit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 944e902d908e84b348449868b669df4e39b78079abc91d44aecdba0966ad124f The package presents itself as a data-transformation/UI utility but on require unconditionally loads setup.js and lib/telemetry.js, both of which...

Malicious code in speed-hashes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 120e6126065bccc254b925a6913422c0cbdd201054437820369c2726fd4a2871 setup.py defines a custom install command NativeInstall that runs on pip install. After the normal install step, a base64 literal COMPATPAYLOAD is...

Malicious code in bigops-nitro-events-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d222994e1816e63b4047f5396bbfda8d6d2ccd6bbc840da4872aa026f879525 The package's index.js requires./shim on load. shim.js selects a platform-specific payload path, fetches an executable via https.get from one of thre...

Malicious code in bigops-products-timeline-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83a98df74705a505fc378b760c3560eea108ccdce63e33c8733b56730efe324e The package advertises itself as shared primitive types with a trivial no-op class in index.js, but index.js unconditionally requires loader.js, whos...

MAL-2026-13135 Malicious code in dolyame-ui-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3df9ea5c492e81553a008ca4fbc71c2c4824b6278bb6a81f11d5e8dc005f561e On package load, index.js requires./platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12887 Malicious code in bnpl-blocks-atom-bnpl-promocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e8267458027ff6475a9d2274d663d26e3869a3646dd35ef5d4bd547f79cde6 On require of the package's main entry, helpers.js runs a bootstrap routine that downloads an OS-specific binary from Cloudflare Workers hosts...

Malicious code in bnpl-blocks-desktop-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a42e260d378e0b517e59b4656f10bb75ffe083a5f8431b4d6a908ec4dae0cb0 On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

MAL-2026-12927 Malicious code in bnpl-blocks-desktop-bnpl-header-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1af1b8630f713bc29fd99f332ba8035b26022f01199e755f2909d3440019fff On require of the package, index.js loads adapter.js whose top-level main constructs Cloudflare Workers hostnames oob-worker.cf100-3-.workers.dev and...

MAL-2026-13069 Malicious code in boxy-mm-advisor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32b540f41a9d31185da353531b46adbb4d2bc9bd9b43efb79a4f8e80fbd51f8a On require of boxy-mm-advisor, index.js loads init.js which auto-runs init. The module reconstructs C2 hostnames via array-split-and-join obfuscation...

Malicious code in boxy-storybook-addon-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ec351f143fde732be84b60d329ba254cda918df3ebb25882371a8c5d96a3dd0 On require of the package, index.js loads ext.js which downloads an opaque platform-specific binary from one of four hardcoded Cloudflare Workers hos...

Malicious code in bpm-foundation-delegate-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ff3bed0d9c04b7357e684ac9feee57efd9dcfc6c5834dc352089b425e7577dc On require/import of the package, index.js loads setup.js at module top level, which assembles attacker-controlled hostnames from split string...

MAL-2026-12548 Malicious code in checkout-commit-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...

Malicious code in cobrowsing-exception-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 715fc9a652bf5d69755ea21ef2a906c318c511fe433df0721a13e266c3646832 On require of cobrowsing-exception-filter, index.js unconditionally loads support.js, which selects a platform-specific endpoint from a hardcoded lis...

MAL-2026-12658 Malicious code in cobrowsing-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1bf15c3c22d00f3a54f331ad3195c9072a94320a03f0f519dfbe95ca2e834de [email protected] executes a full-host dropper on require. index.js loads support.js, which on import reconstructs obfuscated hostnames fr...

Malicious code in devplatform-iam-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494d7de346ffd38cb213791a60c0a1e19d6391e79643e052d31c8ac1e8028b3f The package presents a no-op DevplatformIamClient export, but index.js unconditionally requires./init.js on load. init.js selects a platform-specific...

MAL-2026-12748 Malicious code in devplatform-s3-resources (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85d9e5338b835856fe3c5e45555c1a6bfbb6b7f412a83bbfaa0841813eeeeeb1 On load, index.js unconditionally requires./compat.js, which selects a platform-specific binary URL from string-split-obfuscated Cloudflare Workers...

Malicious code in devplatform-spa-plugin-thermostat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe54d9f541a205ad779acf3da6216c85ec0e20b6a502aaff03dc88b7cf2d85c7 On require, index.js loads compat.js which selects a per-platform payload path, downloads a binary over HTTPS from rotating Cloudflare Workers...

MAL-2026-12380 Malicious code in fb-forms-form-boilerplate-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23bb3ca46733a388c550c5a1f6514c78b026447f355fcc669d1dfa0d58e8963a Package advertises itself as a form-boilerplate library but its top-level index.js unconditionally requires init.js, which on load downloads a...