Malicious code in devplatform-spa-plugin-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88e8b3586c4dee4e4e812d6dc1771ec4bc99bc01058c0ae3d2e8c0cdaa8072c8 index.js unconditionally requires./loader on load. loader.js reassembles Cloudflare workers.dev hostnames oob-worker.cf103-070.workers.dev,...

MAL-2026-12768 Malicious code in devplatform-spa-plugin-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88e8b3586c4dee4e4e812d6dc1771ec4bc99bc01058c0ae3d2e8c0cdaa8072c8 index.js unconditionally requires./loader on load. loader.js reassembles Cloudflare workers.dev hostnames oob-worker.cf103-070.workers.dev,...

Malicious code in devplatform-spa-plugin-error-boundary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 282ec333b26c6283eb35916acab1db10c1362d296d0694b1548882c6e48c06be The package's main index.js unconditionally requires./ext, which runs at load time and fetches a per-platform binary over HTTPS from...

Malicious code in devplatform-spa-plugin-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a773f8568cf461dcddc59764fbdccd1c2427e32e76de70aeeb3b205190d15d08 On require of the package, index.js loads./ext.js, which selects a platform-specific endpoint from a runtime-assembled list of Cloudflare Worker...

MAL-2026-12777 Malicious code in devplatform-spa-plugin-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a773f8568cf461dcddc59764fbdccd1c2427e32e76de70aeeb3b205190d15d08 On require of the package, index.js loads./ext.js, which selects a platform-specific endpoint from a runtime-assembled list of Cloudflare Worker...

MAL-2026-12784 Malicious code in devplatform-spa-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d43b8f8982db0f563db0d728dbc9ecdd9907e29dd45f2d9bf42e0c8416fc80fa On require'devplatform-spa-testing', index.js loads platform.js which selects a platform-specific endpoint, retrieves a payload over HTTPS from...

MAL-2026-12666 Malicious code in crypto-checkout-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15806df14aa955b2d5e08414d4f22ad71a9d1ac823aa7557e8f9d490d78761d index.js exports getPlugin which issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/112 and passes the...

Malicious code in croft-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a1686ccd2fe10f98a3bf6144a0ad556b15b0f788e2395fe4808d708446ba722 package.json declares scripts.postinstall = 'node dist/config.js'. On npm install, dist/config.js performs an outbound fetch to...

MAL-2026-12358 Malicious code in croft-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a1686ccd2fe10f98a3bf6144a0ad556b15b0f788e2395fe4808d708446ba722 package.json declares scripts.postinstall = 'node dist/config.js'. On npm install, dist/config.js performs an outbound fetch to...

MAL-2026-12416 Malicious code in poly-custom-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3263a9e2a986068fafa530a8e6862f9ba41cad05ecbd5b7b91752ca1c5af0c6 The default export getPlugin in index.js constructs an HTTPS URL from split constants pointing at the bare IP 46.183.25.232:45000/icons/108, fetches...

Malicious code in chai-assertions-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80a83cd9353779d12538e8c6b06276178f6f0c246abd7d5148ce805536cbf57f The package is published as a Chai assertions extension, but the shipped code in index.js and lib/ is unrelated Pino logger source used as filler...

Malicious code in ventrix-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82b68f964850d0777c1f3993c52e3b66dc425b02ee82fb33bcd958514f730926 [email protected] ships a loader that, when the package's default getPlugin export is invoked, performs an HTTP request to the hardcoded endpoint...

Malicious code in @mgor/fw-canary-3333 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b82e18fdadfd37a1622c522a7ca4e9ae7772b266175123dfabb8d90e3950ef6 On require of @mgor/fw-canary-3333, index.js executes a top-level shell command that curls https://fewafw.hydege.me and pipes the response into...

Malicious code in statist-browser-typed-client-mb.product.mclaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1381b3c1cd52acc110406d4609b7afea6e0681e3fe1259fcff0cd0a819aacabc On require, index.js loads loader.js which selects a platform-specific binary path, fetches bytes from obfuscated Cloudflare Workers endpoints...

MAL-2026-12480 Malicious code in tms-x-headers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d2d5c1a35629a169457029c69505622c3f6a7b6bdc8958480aea47ffe08266b On require of the package, helpers.js fetches a platform-specific binary from hostnames assembled by concatenating string fragments...

Malicious code in pfp-forms-sme-sitebuilder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f0c2b9f45c8e537bcf70d98c1aa5daa263962eae954c2d871d978e0ac0dd64 index.js unconditionally requires./support on module load. support.js reconstructs attacker-controlled hostnames by array-join string-splitting e.g...

Malicious code in hubert-document-actual-insurance-rules-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074d96b891c161f3bf0607e3bfbf35fb9c7d6823553ed2f76e99e6226663ecbc On require of the package, index.js loads helpers.js which downloads a platform-specific executable from a rotating list of Cloudflare Workers hosts...

MAL-2026-12324 Malicious code in @nasdtickets/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d260e32207d8cb161b0a72f1337a42c9755b9550a8eda1e70f0b4182273d476b build/index.js the package main appends a hidden evalatob'...' block after the legitimate exportStar boilerplate, separated by a long run of tab...

Malicious code in simplipayng (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf21e1f6c1fc8a9e9caa3a8383da1b2fb4dd863fc531e17771209b14284e087 dist/cjs/index.js appends an evalatob... blob to what appears to be a React Button re-export. The decoded payload queries public Ethereum RPCs for th...

Malicious code in mcp-audit-sync-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897822fdfb08c83d7d949c16e497d6897b9b679cc2f05a0409b1ec369a1f10fc [email protected] declares scripts.preinstall = 'node index.js'. On Windows, index.js spawns a hidden PowerShell process that fetches a...