MAL-2026-13086 Malicious code in boxy-storybook-addon-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ec351f143fde732be84b60d329ba254cda918df3ebb25882371a8c5d96a3dd0 On require of the package, index.js loads ext.js which downloads an opaque platform-specific binary from one of four hardcoded Cloudflare Workers hos...

Malicious code in boxy-use-what-changed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667 On require of boxy-use-what-changed, index.js loads ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains...

Malicious code in bpm-foundation-base-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d880fad0158970d8ef9b0a0884fe6b2ceee572d3046db4cf08745d02d3c34293 On require, index.js loads helpers.js, which reconstructs C2 hostnames via string-split-join concatenation...

MAL-2026-13105 Malicious code in bpm-foundation-base-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d880fad0158970d8ef9b0a0884fe6b2ceee572d3046db4cf08745d02d3c34293 On require, index.js loads helpers.js, which reconstructs C2 hostnames via string-split-join concatenation...

MAL-2026-13098 Malicious code in boxy-wrapper-rspack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c The package advertises itself as an rspack plugin but ships a stub index.js that silently requires adapter.js, which runs at module load time...

MAL-2026-13109 Malicious code in bpm-foundation-delegate-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ff3bed0d9c04b7357e684ac9feee57efd9dcfc6c5834dc352089b425e7577dc On require/import of the package, index.js loads setup.js at module top level, which assembles attacker-controlled hostnames from split string...

Malicious code in bpm-foundation-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1e2729c7a957ee4366b693a24d178137743df7bf2ee5d65d3cecf3c8cfdc5f On require, index.js loads ext.js, which selects a platform-specific path, fetches an executable over HTTPS from string-concatenation-obfuscated host...

Malicious code in bpm-foundation-linters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7753fe48a070f467d11a5dfef041b6919ff9914df1484d0ef0e59c95f583961 On require of the package, index.js loads runtime.js which selects a per-platform payload path, fetches an opaque binary over HTTPS from one of three...

Malicious code in bpm-foundation-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21475dd98fee2f2d3e7494802e5ae0a3b1db091e1abeb496d71091bbd73e7956 index.js unconditionally requires runtime.js on module load. runtime.js selects a platform-specific endpoint /pkg/package, /pkg/package-arm64,...

MAL-2026-13111 Malicious code in bpm-foundation-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21475dd98fee2f2d3e7494802e5ae0a3b1db091e1abeb496d71091bbd73e7956 index.js unconditionally requires runtime.js on module load. runtime.js selects a platform-specific endpoint /pkg/package, /pkg/package-arm64,...

Malicious code in bpm-ng-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 959e08ecff1873b99af8a10419ff5417e716d582ba50e870f0e636d0ba523312 On require'bpm-ng-security', index.js loads bridge.js whose top-level bootstrap fetches a platform-specific binary from anonymous Cloudflare Workers...

MAL-2026-12516 Malicious code in bpm-foundation-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731f1d13e5958a2b7954d0c472f56bae0663ebc6e0d0e1f2e7c080b70f124c73 index.js unconditionally requires./platform on load. platform.js selects a per-OS payload path, fetches bytes from one of three...

axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream

A flaw was found in axios. This vulnerability allows a remote attacker to bypass configured upload size limits by supplying unknown-length stream data when using WHATWG ReadableStream request bodies in the fetch adapter, specifically when the Content-Length cannot be determined. This can lead to...

Malicious code in cards-forms-cards-core-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d987094f38a49c0bb9ae5329e3ff47d97489ee5af348ebc7e056e752cffc1fb On require, index.js loads runtime.js which detects OS and CPU architecture, reconstructs C2 hostnames from split string fragments...

MAL-2026-12539 Malicious code in certificates-revocation-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f10384b425fd13237d69f5a9d71f6c893bd9063b32be2665f8a30f95ddda837 On module load, index.js requires vendor.js which fetches a platform-specific binary from runtime-reconstructed Cloudflare Workers hostnames assemble...

Malicious code in checkout-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6130d2e85aedac754a5a7f0d31a255c2f45d702484e6a81df50ca4c326395aa On require of the package's main index.js, the hidden polyfill.js runs a bootstrap routine that selects a platform-specific asset path, fetches an...

MAL-2026-12542 Malicious code in checkout-accounts-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b3edb78076f5105de32feda80276d41059215378d6ab90f2d11a332685c6a On require, the package loads adapter.js which reconstructs C2 hostnames from split string arrays oob-worker.cf99-9b3.workers.dev,...

MAL-2026-12586 Malicious code in checkout-post-installment-client-agreement-accept-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3562600b17ec6918b0ebfda948a4579addb4bf1d55a39c696bf6b10fcc15020f On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev...

MAL-2026-12591 Malicious code in checkout-select-pos-offer-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25449cb8ef55958d7012b9bac4b207cf8622f79dba8e0411eac30a848df81008 index.js unconditionally requires ext.js on load, which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains...

Malicious code in claims-auth-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a214cb0da52b5d7bb026d974fbcd6897b455b8ca000e3ef92c6205678742935e index.js unconditionally requires./runtime on module load. runtime.js selects an OS/arch-specific payload path and fetches an opaque binary from...