MAL-2026-13315 Malicious code in dolyame-boxy-independent-bnpl-code-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7222a6cf31e1412fd943bcf3b140b02f6c615b1650f9c39cabf813801557ae On require of the package, index.js loads ext.js which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers hosts...

Malicious code in boxy-demo-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4fef0cd8b9f91923e6bf6bf357c229e57bb3b108b48ddc3bc9f0faa8f16b8db On require, index.js loads bridge.js which fetches a platform-specific executable from Cloudflare Workers subdomains whose hostnames are reassembled...