Malicious code in boxy-fixture (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb575dd1ac71dc5968106b313680bb84dd0d90172e82c1a79887b085ba55b4bd On require of the package, index.js loads support.js which executes setup at module load. The code reconstructs Cloudflare Workers hostnames...

Malicious code in cards-forms-clone-debit-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af0f7b9b02ef9fef4376ec3f311e60acabe0881cd5ef1ffa503571bdce2158a4 On require, index.js loads bootstrap.js which reconstructs endpoint hostnames from split string fragments assembling .workers.dev hosts such as...

MAL-2026-10193 Malicious code in py-base58 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4ef10f40dc13a645cebdee601417b590c92ab69039dbdf9962c36b36497949b py-base58 2.1.3 masquerades as a pure-Python base58 encoder but on first import of the top-level base58 package decodes a 640KB base64-embedded Linux...