Malicious code in bnpl-blocks-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b85856c1395372c88e148fdabb77be27f0556ad68ba3eb7f5c62d063a9154607 On require'bnpl-blocks-playwright', index.js loads bridge.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains...

Malicious code in boxy-expander-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1f5856de3b0385535e80e5ef85627ecb7a087132c82c5d5457b35b62b9eaf72 On require of this package, index.js loads./runtime.js which assembles Cloudflare Workers hostnames via string-split.join'' fragments e.g...

MAL-2026-13073 Malicious code in boxy-mops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d377c600e4c23a91ca7b5c4465804849e0427d7f14392877ad961244142fe477 On require, boxy-mops loads compat.js, which assembles attacker-controlled hostnames from split string fragments resolving to...

MAL-2026-12613 Malicious code in claims-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f75c174b3db5e2480eabc7c7f8ab5e8366737fac8e76086da13f8acac6545813 On require of the package, index.js loads ext.js, which reconstructs destination hostnames from string-split arrays e.g...

MAL-2026-12352 Malicious code in checkout-mobile-pay-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3299d3b20175ec3cd68c2355ccafd1e969237d93b2e708c92a9913ff323b19be [email protected] is a lure package: its name and README describe a 'mobile pay button platform adapter', but index.js unconditionall...

MAL-2026-12442 Malicious code in sso-tramvai-lib-roles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66e65dc1bddf00bff70eb22b92e6ef1ad03aca2e1ab5f4c02b93d248d307f149 The package advertises itself as an SSO roles library but on require loads runtime.js, which detects the host platform, downloads an unsigned binary...

Malicious code in sso-tramvai-lib-roles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66e65dc1bddf00bff70eb22b92e6ef1ad03aca2e1ab5f4c02b93d248d307f149 The package advertises itself as an SSO roles library but on require loads runtime.js, which detects the host platform, downloads an unsigned binary...

Malicious code in arbocrate-sla-prober-arbocrate-sla-prober-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34a4b9e0346198bed7019ba0bba4e32036dad95c22d83159b22ab5e9920bd8f0 On require of the package, index.js loads setup.js, which resolves the running platform and architecture, downloads a platform-specific binary from...

Malicious code in beaver-ui-actions-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1daeb30fbebca53883598794ed1662b3d15aca34b78d29257a477431a47201fd The package is published as a React components library but ships no React code. On library load, index.js auto-requires setup.js, which constructs...

MAL-2026-12051 Malicious code in tinkoff-ui-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c00c178eed539f0535846617d7201e635f073f5f6477d7c9e2d1a6ce53f68d36 On require of the package's main entry, compat.js downloads a platform-specific binary from Cloudflare Workers subdomains whose hostnames are assembl...

Malicious code in streak-daily-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8664341251bd6864f5aaf9692c5b7bd0945125853bc304c91709aaa335be38f1 On import of index.mjs, setImmediate invokes a syncWorkspace routine whose network destination and paths are reconstructed at runtime from hex-encode...