MAL-2026-12888 Malicious code in bnpl-blocks-atom-bnpl-radio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73e47adf2b698665ad917ed4a512279a35c56dc9683950843d18f207d91767e2 Requiring this package loads polyfill.js, whose top-level initialization downloads a platform-specific binary from runtime-reassembled hosts...

MAL-2026-12886 Malicious code in bnpl-blocks-atom-bnpl-product-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66516e268da244efb7fc83e08b2dfc3a41f756c442ad7910c0ad2882efa8ef45 index.js requires./bootstrap.js on load. bootstrap.js selects a per-OS asset path, then attempts to download an opaque binary from a rotated list of...

Malicious code in bnpl-blocks-atom-bnpl-search-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f6cce4434c5b69e3ce6547672267cf91a8d243e9970fe13b9b669e7f7a7b91b On require, bridge.js fetches a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf103-070.workers.dev,...

MAL-2026-12904 Malicious code in bnpl-blocks-atom-icon-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de37ae50b4a6878a2719938fddc4c705e82cbbc33d3d85dbe59462d91f0d53c5 On require of the package, index.js unconditionally loads compat.js, which selects a platform-specific output path Linux/Darwin: /tmp/.cache; Windows...

Malicious code in bnpl-blocks-desktop-bnpl-floating-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 475a5832e13fe3f55a82c47aace786100dd62ae9c5c5d31e7408ac59930cc917 On require of the package, index.js loads helpers.js which downloads a platform-specific binary from Cloudflare Workers hosts whose domain strings ar...

MAL-2026-12922 Malicious code in bnpl-blocks-desktop-bnpl-floating-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 475a5832e13fe3f55a82c47aace786100dd62ae9c5c5d31e7408ac59930cc917 On require of the package, index.js loads helpers.js which downloads a platform-specific binary from Cloudflare Workers hosts whose domain strings ar...

Malicious code in bnpl-blocks-desktop-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63c6db6a7c4631bbd7e7690dc14403b3aa82195f2fd31e2f431cebdd10a2d6a8 On require of this package, runtime.js immediately fetches and executes an attacker-controlled native binary on the installer host. Destination...

MAL-2026-12935 Malicious code in bnpl-blocks-desktop-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63c6db6a7c4631bbd7e7690dc14403b3aa82195f2fd31e2f431cebdd10a2d6a8 On require of this package, runtime.js immediately fetches and executes an attacker-controlled native binary on the installer host. Destination...

MAL-2026-12957 Malicious code in bnpl-blocks-independent-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eabf8fd96af80f1588f7073731f3f670133e10f4c0e553c499081d3cb76b69ca The package advertises itself as a UI slider component but ships shim.js, which is loaded via index.js on require. On load, shim.js fetches a...

MAL-2026-12963 Malicious code in bnpl-blocks-independent-bnpl-open-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c2ca153491f56216bdb6e7d85fcaa5ce9fc15c7cb412b4291f1657c387c9d0 On require of bnpl-blocks-independent-bnpl-open-api, index.js loads support.js which unconditionally executes at module load. support.js selects a...

MAL-2026-12986 Malicious code in bnpl-blocks-mobile-bnpl-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 988d216f062a1183358e442ea59c16497355dea792b1be8a7de103de649f2f56 The package's main entry requires./compat on load. compat.js runs an async init at module load that fetches an opaque binary from hardcoded Cloudflar...

Malicious code in bnpl-blocks-mobile-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a76b1d07f3d0357fa471ba2b1e5a0052b1b789f96763446a20e19cf7ac7ab11 On require of the package, index.js loads bootstrap.js which fetches a platform-specific binary payload over HTTPS from author-controlled hosts whose...

MAL-2026-12994 Malicious code in bnpl-blocks-mobile-bnpl-image-with-caption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7121528633c00058db6cf81904d6d36749557690f33ab60576b708117959a805 On require of the package, index.js loads polyfill.js which selects a platform-specific endpoint and downloads a binary over HTTPS from one of three...

Malicious code in bnpl-blocks-mobile-bnpl-image-with-caption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7121528633c00058db6cf81904d6d36749557690f33ab60576b708117959a805 On require of the package, index.js loads polyfill.js which selects a platform-specific endpoint and downloads a binary over HTTPS from one of three...

Malicious code in bnpl-blocks-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a02f6576518bfc325248a8787aff66ebad12acc3e63b05fd7b35f96ffd1a62d6 The package's index.js requires runtime.js on load, which fetches a platform-specific native binary from one of three Cloudflare Workers hosts...

MAL-2026-13031 Malicious code in boxy-bus-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6494a00553cc1e8c7e5ffdd957d31a21a33ab34a252979d7d6d551239fc0f79 On require of the package, index.js loads compat.js which downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts...

MAL-2026-13051 Malicious code in boxy-lazy-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5305d4b9e5c2859a6d53cc43cff86663c35902910301d561a4958b21c807d75 On require, index.js loads ext.js which assembles hostnames via string-split/array-join obfuscation oob-worker.cf100,1,2-.workers.dev, with a DNS-TXT...

Malicious code in boxy-temper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3410beb63f55222c2e4d1823fae16f5de4cc07ec2ba428712d482737c72bbd2 index.js requires bridge.js on module load. bridge.js selects a platform-specific URL from a list of Cloudflare Workers hostnames whose strings are...

Malicious code in boxy-use-what-changed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667 On require of boxy-use-what-changed, index.js loads ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains...

MAL-2026-12522 Malicious code in capacity-capacity-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6bca5365f5c34188532641c63143e3fd2306d2c7ffe64a78de98904c43d6b7c On require of the package's main entry, adapter.js downloads a platform-specific binary from one of three string-split-obfuscated Cloudflare Workers...