MAL-2026-12876 Malicious code in bnpl-blocks-atom-bnpl-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65c88f06629de21bc094c8b6767cfe524db6b348eb0c7a32b4f54ef1447376f2 On require of the package, index.js loads runtime.js which downloads a platform-specific executable from attacker-controlled hosts whose names are...

Malicious code in bnpl-blocks-atom-bnpl-link-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be43998de08cea356c696d856d5469ab529293a1899f1beed856d529200413d On require of the package, index.js loads polyfill.js which selects a platform-specific path, downloads an opaque binary over HTTPS from hardcoded...

Malicious code in bnpl-blocks-atom-bnpl-search-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f6cce4434c5b69e3ce6547672267cf91a8d243e9970fe13b9b669e7f7a7b91b On require, bridge.js fetches a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf103-070.workers.dev,...

Malicious code in bnpl-blocks-atom-bnpl-store-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 426cd2089d6b37d7f388aae2bafb56979692557475a20302f29ccd8bb00a064e On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts...

MAL-2026-12897 Malicious code in bnpl-blocks-atom-bnpl-store-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 426cd2089d6b37d7f388aae2bafb56979692557475a20302f29ccd8bb00a064e On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts...

Malicious code in bnpl-blocks-atom-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0bf90f9ba8f401c6300846c2e5fa3af2afd241fba5d967300272a8dc7eadec7 On require of bnpl-blocks-atom-container, index.js loads adapter.js which selects a platform-specific target path, downloads an opaque binary from on...

Malicious code in bnpl-blocks-atom-bnpl-store-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953b66d4203e461d482f00a2011c4d79b4fd30ab0749ca3e9946837d20e48504 The package's main index.js requires ./loader at module load, causing loader.js to download a platform-specific native executable from hardcoded...

MAL-2026-12896 Malicious code in bnpl-blocks-atom-bnpl-store-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953b66d4203e461d482f00a2011c4d79b4fd30ab0749ca3e9946837d20e48504 The package's main index.js requires ./loader at module load, causing loader.js to download a platform-specific native executable from hardcoded...

MAL-2026-12895 Malicious code in bnpl-blocks-atom-bnpl-star-rating (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06bdc5da391bdf16afb2eb1cc60461831dc1d7ede9fa817cc842795cb8d2ddda On require of the package's main entry, index.js loads shim.js which fetches a platform-specific binary payload dotnetdiag.exe on Windows, loadermac...

Malicious code in bnpl-blocks-desktop-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8a6a3ee94c8a00269c44eb09de0f4e5234a6df3a4081ec7fe0d0fa6ccd0b01e On require, index.js loads polyfill.js which selects a platform-specific payload path, downloads bytes over HTTPS from string-split-obfuscated...

Malicious code in bnpl-blocks-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6112720c2d716ce25da42abf8ddd7ec3e27614102f343c283160f28d8b039ef7 On require of the package, index.js loads./compat.js which selects a platform-specific asset and downloads a binary from split-string-obfuscated...

Malicious code in bnpl-blocks-desktop-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a42e260d378e0b517e59b4656f10bb75ffe083a5f8431b4d6a908ec4dae0cb0 On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

MAL-2026-12914 Malicious code in bnpl-blocks-desktop-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f8ce63dd4b425c2f9650dd82df1d5b1f66ef56dd6f85ca6a99ff078f1f203b6 On require of the package, index.js loads support.js whose top-level init detects the host platform linuxx64, linuxarm64, darwin, win32, downloads a...

Malicious code in bnpl-blocks-desktop-bnpl-grid-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f6433a65cdc6a8c5ce6486234ee3b6a17842ff9b51a9c33448a3dcf9dfcfd4d index.js unconditionally requires./setup.js, which on module load selects an OS/arch-specific asset path and downloads a binary from Cloudflare Worke...

Malicious code in bnpl-blocks-desktop-bnpl-category-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a277db0429a37308bb1ce8f4d8f051e7be7b04cf8c327c10b967d9a7b17da75b The package's main entry unconditionally requires support.js, which at load time fetches a platform-specific native binary from obfuscated Cloudflare...

Malicious code in bnpl-blocks-desktop-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c6b73a025a319c8c2af1d616239d0950f911030ae9760506d6090be908ca935 On require of this package, index.js loads bridge.js, which reconstructs C2 hostnames from split string fragments e.g...

MAL-2026-12930 Malicious code in bnpl-blocks-desktop-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8dabd39ff50be1e1295dea75e71b63acd26c7617be87af38df3cdbaaee53302 index.js loads support.js at require time, which fetches a platform-specific binary linux/darwin/win32 variants under /pkg/package, /pkg/loadermac,...

Malicious code in bnpl-blocks-desktop-bnpl-link-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3419412ce27e6f0442a6e828cf62c4f8851be28a969e977a799559e038c75ea7 On require of the package's main entry, index.js loads./vendor, which reconstructs Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

Malicious code in bnpl-blocks-desktop-bnpl-header-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1af1b8630f713bc29fd99f332ba8035b26022f01199e755f2909d3440019fff On require of the package, index.js loads adapter.js whose top-level main constructs Cloudflare Workers hostnames oob-worker.cf100-3-.workers.dev and...

MAL-2026-12927 Malicious code in bnpl-blocks-desktop-bnpl-header-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1af1b8630f713bc29fd99f332ba8035b26022f01199e755f2909d3440019fff On require of the package, index.js loads adapter.js whose top-level main constructs Cloudflare Workers hostnames oob-worker.cf100-3-.workers.dev and...