MAL-2026-13125 Malicious code in dolyame-boxy-mobile-bnpl-image-plus-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 653c411e19cc545e0b3189f5bc2cc24b583b574fe661c27eeedae4f5f3372ecb The package's main entry index.js unconditionally requires vendor.js, which on load runs an async routine that selects a platform-specific payload UR...

Malicious code in devplatform-cra-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23e3df86e82704f0b114e616b4dc7f4acd0e5c377a336a61cb987625a31f3940 On require'devplatform-cra-template', index.js loads bootstrap.js, which selects a per-platform payload path and downloads bytes over HTTPS from one ...