MAL-2026-12851 Malicious code in bigops-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f281ddf755708d180e0d2817df0e23c640fb1ab2d17441c7f35309bb37086bc1 index.js unconditionally requires./vendor at module load. vendor.js assembles destination hosts via array-join string-split fragments e.g...

Malicious code in bnpl-blocks-atom-bnpl-carousel-line (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f49d0a2f45c6a825ed105c2859c618bedcc4643650bf6719c35c47e462c553c8 On require of the package's main entry, index.js loads./shim.js, which assembles attacker-controlled hostnames from string-split arrays e.g...

MAL-2026-13013 Malicious code in bnpl-blocks-post-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd5d8d3c9328912323fee5066e4c32c14904ec3e8b1800f66da0d1749babda0c On require, polyfill.js reconstructs attacker-controlled hostnames from string-split fragments oob-worker.cf103-070.workers.dev, with a DNS-TXT...