MAL-2026-13529 Malicious code in bnpl-blocks-atom-bnpl-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfb9fc4e628aff9ca7ab9df6b7a2b65c27eb1a094e4d64ff002a98f35eb58e1 On require, index.js loads bridge.js which selects a platform-specific asset path, fetches a binary over HTTPS from runtime-assembled Cloudflare...

Malicious code in boxy-use-what-changed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667 On require of boxy-use-what-changed, index.js loads ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains...

Malicious code in twork-data-services-proxy-prime-api-v1-account-overdraft-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e5494883e9415a6efbc2775e753d413e111f02709b95688c94e09013dc8db8 On require of this package, index.js loads adapter.js which selects a platform-specific asset path /pkg/package, /pkg/package.exe, /pkg/loadermac,...