MAL-2026-12736 Malicious code in devplatform-react-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e5dd30e287186df59dd24c05aa269894c259f42c8a2a214d513e55c6510474e On require of the package's main entry index.js - init.js, the module reconstructs a set of Cloudflare Workers hostnames from string-split fragments...

MAL-2026-12735 Malicious code in devplatform-react-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422556511a13a0424a33cfdb404a289d3fd51a0f7f206b4de8114fe69a0874b6 On require'devplatform-react-form', index.js loads adapter.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers...

Malicious code in devplatform-spa-plugin-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22202ea28f902a0048608456e99803ff08f06d111ce97813292e2b1d018c06ec [email protected] advertises itself as an analytics library, but on require its main entry loads adapter.js which downloads a...

MAL-2026-12762 Malicious code in devplatform-spa-plugin-beaver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4a35163a32dc9e4e60b1e9b09f33362ac19ea6e1486dfb4141a98a5263d1fa6 On require, the package's init.js selects a platform-specific URL from a set of Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-spa-plugin-beaver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4a35163a32dc9e4e60b1e9b09f33362ac19ea6e1486dfb4141a98a5263d1fa6 On require, the package's init.js selects a platform-specific URL from a set of Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-spa-plugin-root-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5ac277cf4ba72cf1040b5e06d6875a7228d7ec491d93423198e2b2f92ecb6a Package presents as a Sentry-related SPA plugin but the exported class is an empty stub; index.js requires bootstrap.js, which on load selects a...

Malicious code in devplatform-spa-route-tree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eabd446648c0aff2fa8f21202eeee1f46366ff6678c7811f951ff7f2413616cd On require of devplatform-spa-route-tree, index.js loads loader.js which downloads a platform-specific binary from hostnames assembled via array-join...

MAL-2026-12465 Malicious code in streak-daykey-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bfd8e4427384eea912513d380b6615e3213b2df455b3dd42e2292467127b307 On module load, index.mjs invokes flushInternalData, which creates /.cache/openlarq, downloads a binary from a base64-obfuscated Backblaze B2 URL...

Malicious code in streak-core-insights (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54c92b91e60c1852de5e84952155bf8aadca8ca1a0e7e784e0e1fa4d25e8c641 The package advertises calendar-day math but on module import runs an obfuscated initializer that gates on Linux + WSLDISTRONAME, then downloads...

MAL-2026-12366 Malicious code in dolyame-boxy-independent-bnpl-open-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b38c4f57c90f57ca8c3a54ebf790e726dcbba0be7a662f3ae2aa706c5521d5b On require of the package, index.js loads helpers.js which immediately invokes start. start selects a Windows, Linux, or macOS payload path, download...

Malicious code in tcb-web-images (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e4ea2872f88d974e66cc870c5fbfbf92294eb63026155a96bea567a096f4d69 On require'tcb-web-images', index.js loads helpers.js which immediately runs a setup routine that selects an OS/arch-specific URL path and downloads ...

MAL-2026-12443 Malicious code in statist-browser-typed-client-automlplatform.nlppl.searchy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2006c1fa3443455515f9bbabd8bb63161c14be32405d601e0925054c02c0e62e On require of this package, init.js selects an OS/arch-specific endpoint from a list of Cloudflare Workers hostnames reconstructed at runtime via...

Malicious code in statist-browser-typed-client-sme.rko.finance.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f8aa3f187231d6a828b8d3cd99eee3f0b3dbb95abecc8ebf1add2c393f59b15 On require of the package, support.js assembles remote hostnames from split-string array joins e.g. "oob-wo","rker.cf1","02-baf.workers.","dev".join"...

Malicious code in twork-mf-e2e-nitro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eba320ce2333e7bd477470ded20a2be52a334069c482ab957b41772f347f63d On require of the package, index.js loads compat.js which reconstructs Cloudflare workers.dev hostnames via split-string array concatenation...

Malicious code in twork-data-services-counterfree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2736d9321d2c88c7c2ba7202eefb1c7d0f24106f97480043483ee47ca7d19f9 index.js unconditionally requires./init on load. init.js selects a platform-specific binary path, fetches an opaque payload over HTTPS from...

Malicious code in twork-products-taiga2-products-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2a99df0da5a899d01432bee4f862a3915efcd7b98d8334ee08347438105e79c On require of the package, index.js exports a no-op class and unconditionally loads bridge.js. bridge.js reconstructs command-and-control hostnames v...

Malicious code in twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a35dfc30f1440b5057988bc44c6bdaecee3c33317799c140354ed7adae679838 index.js unconditionally requires setup.js on module load. setup.js reconstructs C2 hostnames at runtime from split string fragments resolving to...

Malicious code in twork-data-services-customer-api-v2-customer-vip-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd6182daf75450f1e553f81c3979a275c481690e27d04712285b85a25ebadc3b On require of this package, index.js loads platform.js which selects a platform-specific payload linuxx64/linuxarm64/darwin/win32, downloads an opaqu...

MAL-2026-12290 Malicious code in twork-data-services-customer-api-v2-customer-vip-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd6182daf75450f1e553f81c3979a275c481690e27d04712285b85a25ebadc3b On require of this package, index.js loads platform.js which selects a platform-specific payload linuxx64/linuxarm64/darwin/win32, downloads an opaqu...

Malicious code in tramvai-module-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8841208443b6595c8389bfac3e1cdb59a65ad0bc05a8dd3e01ca5c661287e56 On require of the package, index.js loads setup.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...