Malicious code in bnpl-blocks-atom-bnpl-radio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73e47adf2b698665ad917ed4a512279a35c56dc9683950843d18f207d91767e2 Requiring this package loads polyfill.js, whose top-level initialization downloads a platform-specific binary from runtime-reassembled hosts...

Malicious code in boxy-global-modules-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce609c23d8c990c21c16692270dbb62589c6f63e716994c31e5ed4f466dcad7 On require of the package's main entry, loader.js immediately fetches a platform-specific opaque binary over HTTPS from hardcoded Cloudflare Workers...

MAL-2026-13096 Malicious code in boxy-validate-implicit-deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04288ec5388fa5634c253b28690e3e5b4b1220fbc9d07440fbb1c8a70860b0e5 On require of the package, index.js loads loader.js which selects a per-platform payload path and fetches an opaque binary from one of four hardcoded...

MAL-2026-13097 Malicious code in boxy-webpack-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c209d103503640b71c427b13bc614b157bc1cbcd371c3a35a0f0b060d7f39de On require of the package, index.js loads polyfill.js which downloads a platform-specific binary from one of four string-split Cloudflare Workers hos...

MAL-2026-13111 Malicious code in bpm-foundation-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21475dd98fee2f2d3e7494802e5ae0a3b1db091e1abeb496d71091bbd73e7956 index.js unconditionally requires runtime.js on module load. runtime.js selects a platform-specific endpoint /pkg/package, /pkg/package-arm64,...

Malicious code in checkout-pay-button-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d4bf54bc4e3750c7e9bc6ef385108c37ee00b486858c0576585ef2f88780385 On require, index.js invokes helpers.js which selects a per-OS payload path, fetches a native binary over HTTPS from string-split-obfuscated Cloudfla...

MAL-2026-12626 Malicious code in claims-is-mobile-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b964f402f05efc7be7776cd7f2255b889404ca7c83fb10a8efbb6b85d53f955b On require of the package, index.js unconditionally loads./vendor.js, which selects a platform-specific endpoint, downloads a native binary over HTTP...

Malicious code in claims-should-retry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfeb9953f0f268a6f342f7c5b8d31292bf0f0855b736149d56df7eab1e119ebd On require of the package, index.js loads platform.js, which reconstructs destination hosts from split string arrays e.g. Cloudflare Workers subdomai...

MAL-2026-12667 Malicious code in csc-csc-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0339e6587ac1d675e493fc3edc1e7d325982284f794a681327053e1131ce689c On require of csc-csc-core, index.js loads init.js which downloads a platform-specific binary from string-split obfuscated Cloudflare Workers hostnam...

Malicious code in devplatform-jscodeshift-transforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37b642060b8d602b0de19c132a792a4979dafc0cb06590dc2f10d14fe0980151 On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts destinations...

MAL-2026-12727 Malicious code in devplatform-nx-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8fa5cc0213b5b28609ba1035cb25dd701d3e8690f25b5a3b4dc37f5139fa740 On require of the package, index.js loads support.js, whose top-level init selects a platform-specific asset, downloads a native binary from one of...

MAL-2026-12741 Malicious code in devplatform-react-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b482d551faa8ecb3cb337bd8bacfe5ec193f1bc2cad69b3998e935fbaf413efa The package's index.js requires./init on load. init.js reconstructs Cloudflare Workers hostnames via split-and-join obfuscation...

Malicious code in devplatform-spa-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6127d0c2ccf2b21fdd6f22244b040c905b2296c86c47cc3c4eb012b61a4c455a On require, index.js loads support.js, which assembles Cloudflare Workers hostnames oob-worker.cf.workers.dev and fallback domain sdk.dl.wel1.ru at...

Malicious code in checkout-desktop-total (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under wel1.ru if HTTPS delivery fails. Systems that imported this package...

Malicious code in pfp-block-mobile-vacancy-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29681869c5fcf5be10eebd7b614f602f3232d1f4645b028d817436b5dfabeae5 On require of the package, index.js loads loader.js which unconditionally executes init. init selects an OS-specific payload path, downloads an opaqu...

Malicious code in bpm-foundation-feature-flags (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4736a188169920cb89859c87cc5d53ed9a51db4f368f15546f2b999a6ec12045 On require of bpm-foundation-feature-flags, index.js loads init.js which downloads a platform-specific native binary from obfuscated Cloudflare Worke...

Malicious code in travel-core-typings-reducers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f8a32e0a10123bde764e059abea762d4b0574d57d35e6bd3e92e4d96cdeb245 On require of the package, index.js loads ext.js which downloads a platform-specific binary from runtime-assembled Cloudflare workers.dev hostnames...

Malicious code in twork-data-services-counterfree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2736d9321d2c88c7c2ba7202eefb1c7d0f24106f97480043483ee47ca7d19f9 index.js unconditionally requires./init on load. init.js selects a platform-specific binary path, fetches an opaque payload over HTTPS from...

Malicious code in twork-products-taiga2-products-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2a99df0da5a899d01432bee4f862a3915efcd7b98d8334ee08347438105e79c On require of the package, index.js exports a no-op class and unconditionally loads bridge.js. bridge.js reconstructs command-and-control hostnames v...

Malicious code in twork-data-services-proxy-invest-symbols-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc81e5181d9c63254883ad238b48528c69f67f901daa5876684cc7490de64356 On require of this package, index.js loads init.js which immediately downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints...