MAL-2026-12265 Malicious code in tinkoff-statist-browser-typed-client-jumptaxi.feature.contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c49c7504b3756df1b52427ccdf475385aad6d95ca04add8cd5eb343e5f970f The package's index.js unconditionally requires vendor.js on load, which runs a bootstrap routine that fetches a platform-specific binary over HTTPS...

MAL-2026-12232 Malicious code in tinkoff-boxy-gitlab-labels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995279b7bea8c6d826ee620cb5a31dc38662a1ba4d4b07bda9fc941908daa1e3 On require of the package, index.js loads runtime.js which selects a platform-specific payload path, fetches an opaque native binary from...

Malicious code in tinkoff-fb-app-frame-page-height-dippy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5db9a5313417dcbe6f8514736de7dd82892ad5cdccc261e0064d8f76f8d9613e On require, index.js loads platform.js, which reconstructs C2 hostnames via runtime string concatenation joining fragments such as...

MAL-2026-12284 Malicious code in tinkoff-volna-zustate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01865b8f060a3e4a24f34537d14ace960460519b2e5e3073083c7de9da63bd9e On require'tinkoff-volna-zustate', index.js loads bridge.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in tinkoff-boxy-desktop-mgm-product-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5a7c457a57706b708f2b1e45df0c9746088cbdbb9eaacc598536017272a547 The package's index.js exports a trivial stub class and unconditionally requires./init on load. init.js reconstructs network destinations at runtime ...

MAL-2026-12184 Malicious code in peter-desktop-peter-big-column (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7593cd2f0f03765e6debc06626ee5d771a32e0d7eb579ddca1bfc5ca53bc22e6 On require, index.js loads runtime.js which assembles download hostnames at runtime from split string fragments resolving to...

MAL-2026-12145 Malicious code in beaver-ui-form-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b91edd276d95174766d639bab6981de8e07b4261e57668fc61f8e7dd96cc1e On require of the package, index.js loads polyfill.js whose top-level bootstrap fetches an opaque platform-specific binary over HTTPS from...

Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

Malicious code in twork-products-taiga2-products-investment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64ab6e4ef4d1c4dafd75af4c52d747069dd76fa1ba8d958f2c82ba7fba2e8a0 On require of the package, init.js unconditionally loaded from index.js fetches a platform-specific executable from one of three obfuscated Cloudflar...

MAL-2026-12149 Malicious code in bigops-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 298b294500c5c15a0bbc4404450d640c2c9402f6941e899db74cd47ecc5837ce On require, index.js loads compat.js, which reconstructs Cloudflare Workers hostnames oob-worker.cf101-adf.workers.dev,...

Malicious code in volna-boxy-di-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caad3654d755de84a91ca9afc1d7d393a1e2868b54b0b03020780b7878df28f8 On require, index.js loads compat.js which selects a platform-specific payload path, reconstructs C2 hostnames at runtime from split string fragments...

MAL-2026-12079 Malicious code in volna-boxy-di-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caad3654d755de84a91ca9afc1d7d393a1e2868b54b0b03020780b7878df28f8 On require, index.js loads compat.js which selects a platform-specific payload path, reconstructs C2 hostnames at runtime from split string fragments...

Malicious code in hubert-appointment-v2-task-create-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8f56f6191b24e3c2163a226ca0bb2b76f309fb9a7aabb77f8ebc5ddf63bd109 On require, platform.js reconstructs destination hostnames from split-string arrays e.g. 'oob-worker.cf103-070.workers.dev' assembled from...

MAL-2026-12066 Malicious code in hubert-appointment-v2-task-create-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8f56f6191b24e3c2163a226ca0bb2b76f309fb9a7aabb77f8ebc5ddf63bd109 On require, platform.js reconstructs destination hostnames from split-string arrays e.g. 'oob-worker.cf103-070.workers.dev' assembled from...

MAL-2026-12077 Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...

MAL-2026-12069 Malicious code in nxify-unic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2645ab342655ef98b8905299be8fc515978b43f6cf36ae564c9da827227dd391 On require'nxify-unic', index.js loads shim.js which detects OS/architecture, assembles destination hostnames at runtime by string-splitting and...

Malicious code in tinkoff-boxy-mobile-vivid-heading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 979353bc7d77343797621496972688b79dddd8688f1e1021b04a04c4d0572b31 On require of the package, runtime.js selects a platform-specific asset path and fetches an opaque binary over HTTPS from Cloudflare Workers hosts...

MAL-2026-12042 Malicious code in platform-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...

MAL-2026-12044 Malicious code in specials-mvno-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 852448e1055feb834486a41aaf7e1a621a52fc4e9a496f34c0bde833e751434b index.js requires bootstrap.js at module load, which fetches an opaque platform-specific binary from string-split Cloudflare Workers hosts...

Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...