Malicious code in trapp-configuration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 370baaa269109c0e76c1e6ff8a0c9a9e1e424c53f3bb835ee53beefd3f2af70c On require'trapp-configuration', index.js loads adapter.js which selects a platform-specific URL, downloads an opaque binary from one of three...

MAL-2026-12303 Malicious code in twork-mf-e2e-nitro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eba320ce2333e7bd477470ded20a2be52a334069c482ab957b41772f347f63d On require of the package, index.js loads compat.js which reconstructs Cloudflare workers.dev hostnames via split-string array concatenation...

MAL-2026-12131 Malicious code in accounts-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b71ef624b0206201b243cfed88cdfc36804bbfd903f60cb7c9da9cfa64b4b2a7 On require of the package, index.js loads helpers.js, which selects a platform-specific endpoint from a list of Cloudflare Workers hosts assembled by...

Malicious code in accounts-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b71ef624b0206201b243cfed88cdfc36804bbfd903f60cb7c9da9cfa64b4b2a7 On require of the package, index.js loads helpers.js, which selects a platform-specific endpoint from a list of Cloudflare Workers hosts assembled by...

MAL-2026-12264 Malicious code in tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba0f8f5362c28a3be51253f23b5bd737f0232d9563d1adcbfb3c891f8ed56dd0 Package main entry require's./adapter on load, which reconstructs Cloudflare workers.dev hostnames and a well1.site fallback domain via split-string...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574d66d11e91bfbe850944dd5bf0cb0f149ebfe6afe59b0a0be6e88c3fb99d3e Package presents itself as a trivial event bus index.js exports a small EventBus class but its main entry unconditionally requires./ext on load. ext....

Malicious code in ml-core-airflow-auth (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a543a55b463967fa7f6b3c1462ecb38735072a4f4f47bf5f9b732e089a64b8a The package advertises itself as an 'auth token handler' but its public API src/mlcoreairflowauth/init.py exposes only a trivial in-memory TokenStore...

Malicious code in veteran-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2528c02db9bcb4016a3347fdfae55c037c0462d6c0d29adb4245605424ad31f On npm install, the postinstall hook node install.js downloads a platform-specific binary archive from a hardcoded...