Malicious code in bnpl-blocks-atom-bnpl-radio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73e47adf2b698665ad917ed4a512279a35c56dc9683950843d18f207d91767e2 Requiring this package loads polyfill.js, whose top-level initialization downloads a platform-specific binary from runtime-reassembled hosts...

Malicious code in bnpl-blocks-desktop-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a42e260d378e0b517e59b4656f10bb75ffe083a5f8431b4d6a908ec4dae0cb0 On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

MAL-2026-12927 Malicious code in bnpl-blocks-desktop-bnpl-header-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1af1b8630f713bc29fd99f332ba8035b26022f01199e755f2909d3440019fff On require of the package, index.js loads adapter.js whose top-level main constructs Cloudflare Workers hostnames oob-worker.cf100-3-.workers.dev and...

MAL-2026-13017 Malicious code in bnpl-blocks-shops-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 209f1c0883ce38bd482d809b83edd85e8d3db75a379909e1b47ee24562c49526 index.js is the declared main entry and unconditionally requires./setup.js on load. setup.js reconstructs attacker-controlled endpoints via...

Malicious code in bnpl-blocks-shops-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 209f1c0883ce38bd482d809b83edd85e8d3db75a379909e1b47ee24562c49526 index.js is the declared main entry and unconditionally requires./setup.js on load. setup.js reconstructs attacker-controlled endpoints via...

MAL-2026-13064 Malicious code in boxy-maker-skeleton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06892152f894a88b72854f0773f64e68336cf6726fd0acc4b3d83c87f06301d3 On require of boxy-maker-skeleton, index.js loads compat.js which reconstructs destination hostnames by string-splitting/join to hide them from stati...

MAL-2026-13069 Malicious code in boxy-mm-advisor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32b540f41a9d31185da353531b46adbb4d2bc9bd9b43efb79a4f8e80fbd51f8a On require of boxy-mm-advisor, index.js loads init.js which auto-runs init. The module reconstructs C2 hostnames via array-split-and-join obfuscation...

Malicious code in boxy-storybook-addon-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ec351f143fde732be84b60d329ba254cda918df3ebb25882371a8c5d96a3dd0 On require of the package, index.js loads ext.js which downloads an opaque platform-specific binary from one of four hardcoded Cloudflare Workers hos...

MAL-2026-13102 Malicious code in bpm-foundation-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5 On require, index.js loads polyfill.js which performs an https.get to hardcoded Cloudflare Workers hostnames assembled by joining string fragments...

Malicious code in boxy-webpack-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c209d103503640b71c427b13bc614b157bc1cbcd371c3a35a0f0b060d7f39de On require of the package, index.js loads polyfill.js which downloads a platform-specific binary from one of four string-split Cloudflare Workers hos...

Malicious code in bpm-foundation-delegate-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ff3bed0d9c04b7357e684ac9feee57efd9dcfc6c5834dc352089b425e7577dc On require/import of the package, index.js loads setup.js at module top level, which assembles attacker-controlled hostnames from split string...

MAL-2026-12547 Malicious code in checkout-checkout-test-block-aff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae29db4ecd6fc6c7250d5b388eb957c9b0d1ec2b8a8966928c3da7c31aa4bf87 On require of the main entry, index.js loads loader.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hosts...

MAL-2026-12548 Malicious code in checkout-commit-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...

Malicious code in claims-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f75c174b3db5e2480eabc7c7f8ab5e8366737fac8e76086da13f8acac6545813 On require of the package, index.js loads ext.js, which reconstructs destination hostnames from string-split arrays e.g...

MAL-2026-12611 Malicious code in claims-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b The package's index.js unconditionally requires./helpers.js, whose top-level main executes on import. It downloads a platform-specific binary from...

Malicious code in cobrowsing-exception-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 715fc9a652bf5d69755ea21ef2a906c318c511fe433df0721a13e266c3646832 On require of cobrowsing-exception-filter, index.js unconditionally loads support.js, which selects a platform-specific endpoint from a hardcoded lis...

MAL-2026-12658 Malicious code in cobrowsing-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1bf15c3c22d00f3a54f331ad3195c9072a94320a03f0f519dfbe95ca2e834de [email protected] executes a full-host dropper on require. index.js loads support.js, which on import reconstructs obfuscated hostnames fr...

MAL-2026-12683 Malicious code in delivery-ci-tech-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63eae2afeb5a45d70f1d217049ab813392464cc8fb099462c716b8573836ed6b On require of the package, index.js loads support.js, which reconstructs hardcoded destinations from split string arrays...

Malicious code in delivery-ci-storybook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f7c5d9585ed160843f93122a7c6f3bda50165c4118618ad7aac0bd1b302069 On require of delivery-ci-storybook, index.js loads bridge.js which downloads a platform-specific executable from one of three anonymous Cloudflare...

Malicious code in devplatform-iam-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494d7de346ffd38cb213791a60c0a1e19d6391e79643e052d31c8ac1e8028b3f The package presents a no-op DevplatformIamClient export, but index.js unconditionally requires./init.js on load. init.js selects a platform-specific...