Malicious code in dolyame-boxy-desktop-bnpl-hero-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 036c11daa7712014748d57bc2bca8a37672acffa8f3eaca83161b726ba473fdb On require of the package, helpers.js reassembles hostnames from split string arrays e.g. 'oob-worker.cf102-baf.workers.dev',...

MAL-2026-13324 Malicious code in dolyame-boxy-independent-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation...

Malicious code in dolyame-ui-checkable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ab13fa73d76681896cf6b34c1b61c2c417f03226865384355020bc5a4a0381c index.js unconditionally requires./setup.js on load, so any require/import of the package auto-executes a dropper. setup.js reconstructs a list of...

MAL-2026-13156 Malicious code in dolyame-ui-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ebf602f046406a056b2d9d36768cf4592ae2f8a02375b0fdb5212c3cc1e80ca On require of dolyame-ui-footer, index.js loads./runtime.js which selects a per-OS payload path, fetches a binary via HTTPS from one of three hardcod...

MAL-2026-13181 Malicious code in dolyame-ui-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a91813719fa2a9e32f75eb75dfa1774f222790b2134366fb99fb27114ab4b247 On require of the package main, init.js selects a platform-specific asset and downloads an opaque binary over HTTPS from a rotating set of...

MAL-2026-13189 Malicious code in dolyame-ui-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed24a0ae9dfa9dd545fde1200d967a5625a2daf28ada90efb2ad78fe5bfdc73e On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev,...

Malicious code in dolyame-ui-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed24a0ae9dfa9dd545fde1200d967a5625a2daf28ada90efb2ad78fe5bfdc73e On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev,...

MAL-2026-12852 Malicious code in bigops-umf-statist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da63079fe1017b1a4ade225e41fbb7479ab0a247b235d62b252470ff9f07e1d7 On require'bigops-umf-statist', index.js loads runtime.js which selects a platform-specific endpoint, downloads a binary over HTTPS from...

MAL-2026-12884 Malicious code in bnpl-blocks-atom-bnpl-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80f343dda3cb4e6b3420db34a6a801aeeeaf60ecf1ea23ad78de4c7605b954d2 index.js unconditionally requires./runtime on load. runtime.js reconstructs Cloudflare Workers hostnames oob-worker.cf101,2,3-.workers.dev via...

Malicious code in bnpl-blocks-atom-bnpl-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f37374f9e046ed30b7430e942c4e4f23ddc6ef55e76a3a00b2f40506c0f2bb9 On require of bnpl-blocks-atom-bnpl-text, index.js loads polyfill.js, which selects an OS-specific asset and fetches a binary over HTTPS from...

Malicious code in bnpl-blocks-desktop-bnpl-header-catalog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d77aab31095b1d13ea26c5ca29398e01a205ed0766fe95d5d8978751ebd75e35 The package presents itself as a 'logging middleware' but its index.js unconditionally requires loader.js on module load. loader.js selects a per-OS...

MAL-2026-12955 Malicious code in bnpl-blocks-independent-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62fa2b8c94722055f1345a068fc74b842d0fe8120702208c73f2defd93744194 On require of this package, index.js loads runtime.js which downloads a platform-specific binary over HTTPS from obfuscated hosts...

MAL-2026-12973 Malicious code in bnpl-blocks-independent-bnpl-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56d26dece8e18d84828b36740c2f6b04f29f695b2a0df9c6699b58cc1f83e11a On require of this package, index.js loads adapter.js which selects a platform-specific asset path, reassembles destination hostnames from split...

CVE-2026-61484

creationtimestamp| type| source ---|---|--- 2026-08-05 14:42:21+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/a2wgyu63gboz4...

MAL-2026-12985 Malicious code in bnpl-blocks-mobile-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d34cee08f3d1aef3c44a67fde619cdd51f0653434204b2390064eb0baad9f2c2 The package's main entry requires./compat on load, which selects a platform-specific payload Windows.exe, Linux ELF, macOS Mach-O, downloads it over...

Malicious code in bnpl-blocks-mobile-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3362a69d0a3341fff7a48ebdd4a8231ec5a365dc237c62a5b95619fe051e762 On require, index.js loads bootstrap.js, which selects a per-platform payload path, fetches a binary over HTTPS from hardcoded hosts assembled by...

MAL-2026-13019 Malicious code in bnpl-blocks-stories-of-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2d298c1c7467e50e22e0822fb5a348773e76a2b06ab9028997578c3f1c86121 On require of this package, index.js loads bootstrap.js which downloads a platform-specific executable over HTTPS from a rotating list of...

MAL-2026-13056 Malicious code in boxy-make-tokens-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3b24115f2a42bc7aa25741e66f56e8007a3d0816cab809e1da78740f9a7a2d5 index.js unconditionally requires./loader on module load. loader.js reconstructs three Cloudflare Worker hostnames oob-worker.cf99-9b3.workers.dev,...

Malicious code in boxy-maker-sticky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc3701b8f91a045a21b2a07ba76082afea03e4aea2c9a87a1c1e40e2de88c3b0 On require of boxy-maker-sticky, index.js loads runtime.js which reconstructs C2 hostnames from split string fragments...

Malicious code in boxy-micro-story (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99c59fb669f0608d2c5f3362289aa05a77d09106393fd5370c207509878fe96f On require of the package, index.js loads platform.js which auto-executes an init routine that selects a platform-specific payload, fetches an opaque...