Malicious code in ded-pwa-c-boxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2293ad47611dcfbb22a3ef81df5e4f27dc942bd2bd2fc5865b60948dc6fc671 On require of the package, index.js loads vendor.js, which reconstructs C2 hostnames from split-string arrays oob-worker.cf102-baf.workers.dev and...

MAL-2026-13090 Malicious code in boxy-test-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b9bbda2467ea797cb846a04b6a8c3bb71b3cfed619f7688f533050fa2f51eb [email protected] executes a remote binary dropper on any require of the package. index.js unconditionally loads bootstrap.js, which downloads a...

Malicious code in checkout-postpone-until-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dda2bcf0b52999de23bed014cc8b4fbbe08dea5331db90dc732f2428e373445 On require of the package, index.js loads./vendor.js which assembles Cloudflare Workers hostnames oob-worker.cf.workers.dev family via array-join...