Malicious code in twork-data-services-invest-box-account (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce404950eecf61001f88758ef82a02523d93efe8d29c01f63521ff748b82c553 On module load, index.js requires./adapter.js which detects OS/architecture, fetches an opaque binary via https.get from string-concatenated Cloudfla...

Malicious code in bnpl-blocks-desktop-bnpl-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4909f4a2b9f9355cd2cbde2b75f8a5d7d3f4ec6b79ed828fdb9cc18b23107e0 On require of the package, index.js loads./setup, which selects a platform-specific URL, fetches an opaque binary from string-concatenated Cloudflare...

MAL-2026-12192 Malicious code in scrollbar-hide-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f19e1731b591552a096b108703702b9663c1bbb8cf9c2ff6fc048f8582e8607 The package's main entry dist/index.js appends an obfuscated payload — wrapped in evalatob... with require targets and URLs hidden in \uXXXX escapes ...

MAL-2026-12286 Malicious code in trapp-check-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fea7c6987689190a5c45008fc1bfbf14ae177c63630b38ced1190e0c5c3d7661 On require of the package, index.js loads bridge.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

Malicious code in cors-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c243bfa0251c11e10ceee74a90cffa2189086cf647ad8dfe6d70ab5e3491a5 Package impersonates the widely-used cors Express middleware. lib/index.js copies the legitimate expressjs/cors source but adds an exported getPlugin...

Malicious code in vvvedernikov-test-another-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69575654ed937cf00fb8e19691a12f08f966639ceec4ddc306d65a5af0ab8f83 On require of the package, index.js loads bootstrap.js which selects a platform/arch-specific asset path, fetches opaque bytes over HTTPS from one of...

Malicious code in fb-cards-form-no-resident-information (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f5f533e1e08aafbda3bd64998ad984e90345592ecc1a9fd14f6d449413e6c87 On require of the package, index.js loads adapter.js which reconstructs Cloudflare Workers hostnames from split string fragments e.g. 'oob-worker' +...

Malicious code in accounts-appointment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b85924ae1e24ede2acf333de8af5ca1d8ae2854652be2b3b82a01df710adc27a index.js unconditionally requires./setup, which on load selects a platform-specific payload path, fetches bytes over HTTPS from Cloudflare workers.de...

Malicious code in tailwind-animation-founder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 212392bc085368a2f4227f1cba627c6dd4629855bb5f3aa3529931d35f13ed21 The package publishes as 'tailwind-animation-founder' while its README, homepage, and npm badges point to a differently-named upstream...

Malicious code in tinkoff-statist-browser-typed-client-jumptaxi.feature.contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c49c7504b3756df1b52427ccdf475385aad6d95ca04add8cd5eb343e5f970f The package's index.js unconditionally requires vendor.js on load, which runs a bootstrap routine that fetches a platform-specific binary over HTTPS...

MAL-2026-12265 Malicious code in tinkoff-statist-browser-typed-client-jumptaxi.feature.contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c49c7504b3756df1b52427ccdf475385aad6d95ca04add8cd5eb343e5f970f The package's index.js unconditionally requires vendor.js on load, which runs a bootstrap routine that fetches a platform-specific binary over HTTPS...

Malicious code in tinkoff-boxy-mobile-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0975c5e634ca65495f0ec35088db60ae98702849f5f2fb31e2ad1d8eee2068b7 On require of the package, index.js loads./platform.js, which selects a per-platform payload path, fetches an unsigned binary over HTTPS from...

MAL-2026-12233 Malicious code in tinkoff-boxy-independent-kasko-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 873f98d16d6e9c4ecb2f5919621cfa940fe0059c48de29b1bb0eff6420527afc On require of the package, index.js loads bootstrap.js which reconstructs hardcoded hostnames via split-string.join obfuscation and downloads a...

MAL-2026-12253 Malicious code in tinkoff-statist-browser-typed-client-art.apps.reporegistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1 On require of the package, adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardcoded Cloudflare Workers host...

MAL-2026-12229 Malicious code in tinkoff-boxy-desktop-mgm-product-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5a7c457a57706b708f2b1e45df0c9746088cbdbb9eaacc598536017272a547 The package's index.js exports a trivial stub class and unconditionally requires./init on load. init.js reconstructs network destinations at runtime ...

Malicious code in tinkoff-statist-browser-typed-client-automlplatform.nlppl.classica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 801b453825e385d0c0c659b2037a6f8fcbcdfa0c0ae519ae103280639cd8ed99 Package name mimics a Tinkoff internal namespace and ships a loader that runs on require. index.js requires./init on load; init.js selects a...

MAL-2026-12251 Malicious code in tinkoff-pfpa-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a29d523fe4960435cd996806856c38d2fde0c9862135d3a71a14322670f73d41 On require of tinkoff-pfpa-tools, index.js loads adapter.js which downloads a platform-specific native executable from Cloudflare Workers hosts whose...

MAL-2026-12245 Malicious code in tinkoff-pfp-atom-desktop-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72e139cae8466fafe604673154859640f78b9757aae859dcb8f9df07d26184dd On require of this package, index.js loads loader.js which selects a platform-specific asset path, downloads a native binary over HTTPS from randomiz...

Malicious code in tinkoff-codeceptjs-storyshots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 253cf41e1be3d79a36e40038dd5e4776355c95c4eeb41aa40a0b4c7aa321c613 On require of this package, index.js unconditionally loads helpers.js, which at module load time downloads a platform-specific binary from...

MAL-2026-12227 Malicious code in tinkoff-boxy-atom-text-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3606d69d2c4891a247201742fcab0e3069060e9d669e537de5758c5a03279521 The package's index.js unconditionally requires./loader on module load. loader.js selects a platform-specific payload path and fetches bytes from one...