Malicious code in sme-rko-finance-front-operations-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e254c7a7e7f82c38dddb46c9c694cef8f91ac1731565c61e7d17b30d291bd7ac On require of the package, index.js loads shim.js which self-executes an async initializer that assembles platform-specific hostnames from split-stri...

Malicious code in sme-rko-finance-front-operations-income (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7448e3b039f1a22821f5906a1b39378c1259cb5d98090c1b1b8176421482ec0a On require of the package, compat.js reconstructs attacker-controlled hostnames via array split-and-join obfuscation oob-worker.cf101-adf.workers.dev...

MAL-2026-12971 Malicious code in bnpl-blocks-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c9351985ce827df7a44d4de41728052bf0a0013df223954d273b2ad8d6735bf Requiring bnpl-blocks-independent-bnpl-table transitively loads compat.js, which auto-invokes a start routine at module load. The routine downloads a...

MAL-2026-13005 Malicious code in bnpl-blocks-mobile-bnpl-shopping-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a04004bb44c701e1976ef3d6678efb4cd9668d5a4986937c62928d1345550a86 On require of this package, index.js loads polyfill.js which selects a platform-specific download URL, reconstructs hostnames via array.join...

Malicious code in envfile-sync-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 097a9a647e6d99cd53b881cae4fdd747d03b319388107c946c70b8804d3d917b On every import of envfile-sync-cli, src/index.js calls process.dlopen on bin/native/parser.node — a 2.9MB Windows PE executable sha256...