MAL-2026-13051 Malicious code in boxy-lazy-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5305d4b9e5c2859a6d53cc43cff86663c35902910301d561a4958b21c807d75 On require, index.js loads ext.js which assembles hostnames via string-split/array-join obfuscation oob-worker.cf100,1,2-.workers.dev, with a DNS-TXT...

Malicious code in boxy-temper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3410beb63f55222c2e4d1823fae16f5de4cc07ec2ba428712d482737c72bbd2 index.js requires bridge.js on module load. bridge.js selects a platform-specific URL from a list of Cloudflare Workers hostnames whose strings are...

Malicious code in boxy-use-what-changed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667 On require of boxy-use-what-changed, index.js loads ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains...

MAL-2026-12522 Malicious code in capacity-capacity-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6bca5365f5c34188532641c63143e3fd2306d2c7ffe64a78de98904c43d6b7c On require of the package's main entry, adapter.js downloads a platform-specific binary from one of three string-split-obfuscated Cloudflare Workers...

Malicious code in bpm-foundation-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731f1d13e5958a2b7954d0c472f56bae0663ebc6e0d0e1f2e7c080b70f124c73 index.js unconditionally requires./platform on load. platform.js selects a per-OS payload path, fetches bytes from one of three...

Malicious code in cardsmobile-notifications (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a75c5659b227cbea7e622e9c5613594e590fae0580db08420e9f2493b2fd3d2 On require of cardsmobile-notifications, index.js loads support.js which fetches an OS/arch-specific executable from a rotating list of obfuscated...

Malicious code in checkout-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6130d2e85aedac754a5a7f0d31a255c2f45d702484e6a81df50ca4c326395aa On require of the package's main index.js, the hidden polyfill.js runs a bootstrap routine that selects a platform-specific asset path, fetches an...

Malicious code in checkout-accounts-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a On require'checkout-accounts-holder', index.js loads platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames...

MAL-2026-12555 Malicious code in checkout-desktop-cashback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04ab0105316a6f7d59b244610cd7a5c702e2157987ca7b91674cd34d032acf70 On require'checkout-desktop-cashback', index.js loads vendor.js which fetches a platform-specific binary from obfuscated Cloudflare Workers endpoints...

MAL-2026-12557 Malicious code in checkout-desktop-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0 On require of checkout-desktop-legal, index.js loads compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare...

Malicious code in checkout-desktop-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0 On require of checkout-desktop-legal, index.js loads compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare...

Malicious code in checkout-mobile-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e767e42a2a85ea01a996ada873c5ddcea0c13a56a33e44255694786dfe7b8f2 On require, the package loads platform.js which selects a per-OS asset path and downloads an executable payload from hostnames reconstructed at runti...

Malicious code in claims-auth-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a214cb0da52b5d7bb026d974fbcd6897b455b8ca000e3ef92c6205678742935e index.js unconditionally requires./runtime on module load. runtime.js selects an OS/arch-specific payload path and fetches an opaque binary from...

Malicious code in claims-get-percentage-value (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcb53d2b24eba1d763f7d76c41b006cc7a6d236677fcc2749b310cb3389ab161 The package's main entry index.js unconditionally requires platform.js, which on module load fetches a platform-specific executable from hardcoded...

Malicious code in checkout-total-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 297980540b58c9daf802d92602f2a809348bd6ac1492537d6e291f704702dc0a On require of the package, index.js loads platform.js, which reconstructs endpoint hostnames from split string fragments resolving to...

MAL-2026-12614 Malicious code in claims-enums (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e On require'claims-enums', index.js loads polyfill.js which selects a platform-specific asset path and fetches an opaque binary over HTTPS from...

MAL-2026-12625 Malicious code in claims-historical-claims-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 821551bfee1b6a8fa74b001808fad75327d22654f228600f02a6130edc31ce2e On require, index.js loads bridge.js which selects a platform-specific URL path and downloads a binary via https.get from hostnames assembled by...

MAL-2026-12641 Malicious code in claims-replace-url-params (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfdefc5cd3c5418949e2da9656f7b93b174c5b8eb5fa64531736fbd5ae63b1f0 The package's public API in index.js is a no-op class whose only real effect is require"./adapter" on load. adapter.js selects a platform-specific...

Malicious code in claims-use-visual-viewport-resizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a43857f84078ff31ed3df04edf0708e622d0cc10143b7ee2f74e05182519eb On require, index.js loads helpers.js which auto-invokes start. The code selects a platform-specific asset, fetches an opaque binary over HTTPS from...

MAL-2026-12648 Malicious code in claims-use-visual-viewport-resizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a43857f84078ff31ed3df04edf0708e622d0cc10143b7ee2f74e05182519eb On require, index.js loads helpers.js which auto-invokes start. The code selects a platform-specific asset, fetches an opaque binary over HTTPS from...