MAL-2026-13597 Malicious code in dolyame-ui-scrollblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 242ef9ba3c44f135b08ae34b89045c494ab2a94f3642eeb2a6e164e858561cb9 On require of the package, index.js loads helpers.js and lib/telemetry.js, which reassemble Cloudflare Workers hostnames from split string fragments...

MAL-2026-12871 Malicious code in bnpl-blocks-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953d88d16a72d63369a076b864facc257f63385eb38d220ca649b8712ff50277 On require, index.js loads setup.js which selects a platform-specific binary path for linux/darwin/win32, downloads it over HTTPS from hardcoded...

MAL-2026-13082 Malicious code in boxy-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ecbc929cc9a3cab12301c7879112bd95abb78812a0248415cc4f7c075d3eec1 On require of the package, index.js unconditionally loads compat.js, which reconstructs attacker-controlled hostnames from split string arrays...

Malicious code in checkout-cashback-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3 [email protected] silently requires bootstrap.js when the package is loaded. The bootstrap script assembles Cloudflare Workers subdomain...