Malicious code in checkout-desktop-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0 On require of checkout-desktop-legal, index.js loads compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare...

Malicious code in checkout-dolyame-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf1762450e49c2a25e6765179edb585ba02fbc9375b72098fa0804ffae847ac2 On require of the package, index.js loads./runtime.js, which assembles mirror hostnames from split string arrays e.g...

MAL-2026-12576 Malicious code in checkout-mobile-input-email (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9c13bf58568e58ecec010552f23cd8eb27cef188f4ed0c905e832fa0f8d0372 On require'checkout-mobile-input-email', index.js loads helpers.js which assembles hostnames via string-array.join"" e.g...

Malicious code in checkout-mobile-input-email (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9c13bf58568e58ecec010552f23cd8eb27cef188f4ed0c905e832fa0f8d0372 On require'checkout-mobile-input-email', index.js loads helpers.js which assembles hostnames via string-array.join"" e.g...

MAL-2026-12577 Malicious code in checkout-mobile-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c9d5aebe1a3868e44878f382e7dfd21bcbebf8767f3ff0890b2d6330726f945 On any require/import of this package, index.js loads init.js, which selects a platform-specific endpoint and downloads an opaque binary from...

Malicious code in checkout-pay-button-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d4bf54bc4e3750c7e9bc6ef385108c37ee00b486858c0576585ef2f88780385 On require, index.js invokes helpers.js which selects a per-OS payload path, fetches a native binary over HTTPS from string-split-obfuscated Cloudfla...

Malicious code in checkout-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d17ce247f3e7fa94b43e93af7597a9ae8a2a4008048a1ae8deb9352f45fc731 On require of checkout-types, index.js loads vendor.js which runs setup at top level. The code reconstructs C2 hostnames from split string arrays...

MAL-2026-12596 Malicious code in checkout-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48a8b1e3a04ac6f84ba6ee63bcb2c0dd466bba5e78fbded886694ea58c976057 The package presents itself as a small helper library deepMerge/sleep/retry/chunk but its main entry requires./support.js, which at load time downloa...

MAL-2026-12621 Malicious code in claims-get-indexed-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe924c35590524d1632020cce8e08d68b232aa0d53b0f0ecb730f3ae87e07c35 [email protected] executes a binary dropper on module load. index.js unconditionally requires polyfill.js, which reassembles network...

MAL-2026-12630 Malicious code in claims-page-maker-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b337b617f3692fffb0d54a13924ae322ed7e2976c00a61f16c16877aa8c086e5 On require of claims-page-maker-types, index.js loads adapter.js which runs at module load. adapter.js selects a platform-specific asset, fetches an...

Malicious code in claims-to-iso-string-with-timezone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c313bb681d365fedf6993c01c72c1e6e703b2b5124c8c35c19a730d5b2d4f7aa On require of claims-to-iso-string-with-timezone, index.js loads./init.js which downloads a platform-specific binary from obfuscated author-controlle...

MAL-2026-12654 Malicious code in cobrowsing-exception-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 715fc9a652bf5d69755ea21ef2a906c318c511fe433df0721a13e266c3646832 On require of cobrowsing-exception-filter, index.js unconditionally loads support.js, which selects a platform-specific endpoint from a hardcoded lis...

MAL-2026-12655 Malicious code in cobrowsing-k8s-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cde47afeee95884dc83b3dab22855db86950fd58756900af5100d1286a7c7be On require of the package's main entry, bridge.js selects a platform-specific endpoint, reconstructs remote hostnames at runtime via array.join""...

Malicious code in cobrowsing-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a369ea5eb28ebfd7fddb1c5baa3fc22fb371761839c0a2bd7123df273acd2077 [email protected] executes a binary dropper as a side effect of requiring the package. index.js loads helpers.js which auto-runs main at import...

Malicious code in cobrowsing-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1bf15c3c22d00f3a54f331ad3195c9072a94320a03f0f519dfbe95ca2e834de [email protected] executes a full-host dropper on require. index.js loads support.js, which on import reconstructs obfuscated hostnames fr...

Malicious code in delivery-ci-notify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf92bb7d56497b7cc6eb6b7b04a210fb531faa624a9c1b97e830fbf745d6258 On require of delivery-ci-notify, index.js loads shim.js which selects a platform-specific asset, downloads a native binary from one of three hardcod...

Malicious code in delivery-ci-validate-tinkoff-fb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c2b95894675a32af7552c62bb8cd49bbd1d69f64d2685118ed2fede54c0b1a0 The package presents itself as a CI validation helper but index.js calls require'./adapter' on import, causing adapter.js to run automatically...

MAL-2026-12708 Malicious code in devplatform-data-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9d428dae035b88a4c025d9edd346d22cf2dffbb5a21ae597560702280b3949 On require'devplatform-data-table', index.js loads ext.js inside a swallowed try/catch. ext.js reconstructs a rotating list of Cloudflare Workers...

MAL-2026-12725 Malicious code in devplatform-nx-pvm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58df39bb6ab40bc06f0c7db6a10753e81979cae9692633b51a33089ff6d28aa4 On require of devplatform-nx-pvm, compat.js fetches a platform-specific binary over HTTPS from hardcoded hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-12722 Malicious code in devplatform-nx-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc4017373371f50665290c944ee840b2ad4a7e745dcb5eb973f977185b150ac7 The package presents as a devkit for the Nx ecosystem but ships a trivial no-op class in index.js alongside a hidden shim.js. On require, index.js...