Malicious code in delivery-ci-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8753c683761d897d4f95cbdc7567d80c8e455b1d4ade844d24f0367633806335 index.js unconditionally loads setup.js on require/import. setup.js assembles three Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-inputfio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ac05c63a867647d4ec2bf3288918537aeadac4707342a70bfffd42cda60e9c On require of the package, adapter.js and lib/telemetry.js reconstruct destination hostnames from array-joined string fragments...

MAL-2026-13555 Malicious code in dolyame-ui-cardlogo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24f8a4fc7c7641f4b66eb6a3c8dc9535bd66e2632183c5090e0b7ec909f6c2d On load, index.js requires polyfill.js which unconditionally downloads a platform-specific binary from hostnames reconstructed at runtime via...

Malicious code in ded-pwa-test-pub-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g...

MAL-2026-13544 Malicious code in devplatform-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de0fcdb30a4308ee477f432e1bcc665e8ee45f3dd36dd02f22089a4b9e2a69f9 [email protected] ships no ESLint configuration despite its name and description. Requiring the package loads compat.js, which on impo...

MAL-2026-13551 Malicious code in dolyame-boxy-independent-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf17b5bab6439a518226a8e3caf758974a9dd8846e587347ea33356c5f780a53 On require of the package, index.js loads runtime.js which selects a platform-specific binary path, downloads an opaque payload from...

Malicious code in dolyame-ui-inputbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c05d783314187af31df2f0152cc2809660ec45808c3e5f38071e8bfe7ac08dd6 On require of the package, index.js loads loader.js and lib/telemetry.js, both of which act as remote-binary droppers. Hostnames and dangerous API...

MAL-2026-13506 Malicious code in dolyame-ui-inputbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c05d783314187af31df2f0152cc2809660ec45808c3e5f38071e8bfe7ac08dd6 On require of the package, index.js loads loader.js and lib/telemetry.js, both of which act as remote-binary droppers. Hostnames and dangerous API...

Malicious code in bigops-logs-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5a922558781f9614bc47976e2e695cc8a5996ef51865fb5b37928f842718b5d On require of bigops-logs-player, index.js loads polyfill.js, which reconstructs a list of Cloudflare Workers hostnames...

MAL-2026-13236 Malicious code in bigops-products (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c972a30e05df0a94eb9aed3490a04da317cb450b64fd62a7183bca30afe573 On require of bigops-products, init.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are assembled at runtime from...

Malicious code in bigops-storio-ngrx-component-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8f5027d945d8a05fe554b838ba2036e29a99c4296ad532b8d47a1bbaa22650e The package name resembles @ngrx/component-store. The main entry index.js requires./helpers, which on module load assembles attacker-controlled...

MAL-2026-13285 Malicious code in dolyame-boxy-atom-bnpl-dangerously-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48ce2aa10d245536ed6cfd1903fe1b553eef84d8e949b0bd1b970817b7f13e98 On require of the package, index.js loads loader.js which reconstructs attacker-controlled hostnames via string-split.join'' to evade scanners mirror...

Malicious code in dolyame-boxy-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 919c54c4e8e0b08b62f76b85369a9033929f8ea19dfc777b8ece48697229a5ce [email protected] ships a runtime.js module that is unconditionally required from index.js at load time. On import, runtime.js reconstructs...

MAL-2026-13298 Malicious code in dolyame-boxy-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 919c54c4e8e0b08b62f76b85369a9033929f8ea19dfc777b8ece48697229a5ce [email protected] ships a runtime.js module that is unconditionally required from index.js at load time. On import, runtime.js reconstructs...

MAL-2026-13304 Malicious code in dolyame-boxy-desktop-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626b386d1f127bc0ed973dbac051023f0f021b0be476d1cd8678802ef98c5d42 On require of the package, index.js unconditionally loads bootstrap.js, which downloads a platform-specific binary from hostnames assembled via...

MAL-2026-13324 Malicious code in dolyame-boxy-independent-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation...

Malicious code in dolyame-boxy-independent-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation...

Malicious code in dolyame-boxy-independent-bnpl-mobile-application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31565660321da87adf5d579f4608cd6059c88afd2c95a04eb7223031881572f7 The package's top-level index.js unconditionally requires./platform on load. platform.js reconstructs a set of mirror hostnames via string-split...

Malicious code in dolyame-boxy-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 373a9a2757b6b44dde0583e1cf35f5eabe8e360bf732e751630d8bb8ddb72ee6 On require of dolyame-boxy-markdown, index.js loads ext.js which downloads a platform-specific native binary from author-controlled Cloudflare Worker...

Malicious code in dolyame-boxy-independent-bnpl-swagger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c9922ed471321378d155bfabb5d15f3efe59f8524e30face28e25dadd3305b3 dolyame-boxy-independent-bnpl-swagger ships an index.js that unconditionally requires setup.js on load. setup.js reconstructs remote hostnames from...