Malicious code in ded-pwa-c-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49417f27ca8728639dfd54e327ed26072b72fe73db14973ae1b39fb55c8ff52b On require'ded-pwa-c-cms', index.js loads platform.js which selects a platform-specific URL path and downloads an opaque binary over HTTPS from...

Malicious code in dlp-dlp-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a7f83a18ee0f4d41331997bd85740febbb8d8e581fa9026b83112e55d2b8320 On require'dlp-dlp-core', index.js loads setup.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac,...

Malicious code in dolyame-boxy-atom-bnpl-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdafe79f11030f0367fb997cf61cabd383309aca2ba694459be72a97d8023bb7 On require of the package, index.js loads helpers.js which immediately runs an init routine that fetches a platform-specific binary over HTTPS from a...

Malicious code in dolyame-boxy-desktop-bnpl-hero-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 036c11daa7712014748d57bc2bca8a37672acffa8f3eaca83161b726ba473fdb On require of the package, helpers.js reassembles hostnames from split string arrays e.g. 'oob-worker.cf102-baf.workers.dev',...

Malicious code in dolyame-ui-checkable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ab13fa73d76681896cf6b34c1b61c2c417f03226865384355020bc5a4a0381c index.js unconditionally requires./setup.js on load, so any require/import of the package auto-executes a dropper. setup.js reconstructs a list of...

MAL-2026-13181 Malicious code in dolyame-ui-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a91813719fa2a9e32f75eb75dfa1774f222790b2134366fb99fb27114ab4b247 On require of the package main, init.js selects a platform-specific asset and downloads an opaque binary over HTTPS from a rotating set of...

MAL-2026-13189 Malicious code in dolyame-ui-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed24a0ae9dfa9dd545fde1200d967a5625a2daf28ada90efb2ad78fe5bfdc73e On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev,...

Malicious code in dolyame-ui-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed24a0ae9dfa9dd545fde1200d967a5625a2daf28ada90efb2ad78fe5bfdc73e On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev, cf100-416.workers.dev,...

MAL-2026-12852 Malicious code in bigops-umf-statist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da63079fe1017b1a4ade225e41fbb7479ab0a247b235d62b252470ff9f07e1d7 On require'bigops-umf-statist', index.js loads runtime.js which selects a platform-specific endpoint, downloads a binary over HTTPS from...

MAL-2026-12884 Malicious code in bnpl-blocks-atom-bnpl-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80f343dda3cb4e6b3420db34a6a801aeeeaf60ecf1ea23ad78de4c7605b954d2 index.js unconditionally requires./runtime on load. runtime.js reconstructs Cloudflare Workers hostnames oob-worker.cf101,2,3-.workers.dev via...

MAL-2026-12955 Malicious code in bnpl-blocks-independent-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62fa2b8c94722055f1345a068fc74b842d0fe8120702208c73f2defd93744194 On require of this package, index.js loads runtime.js which downloads a platform-specific binary over HTTPS from obfuscated hosts...

MAL-2026-12985 Malicious code in bnpl-blocks-mobile-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d34cee08f3d1aef3c44a67fde619cdd51f0653434204b2390064eb0baad9f2c2 The package's main entry requires./compat on load, which selects a platform-specific payload Windows.exe, Linux ELF, macOS Mach-O, downloads it over...

MAL-2026-13019 Malicious code in bnpl-blocks-stories-of-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2d298c1c7467e50e22e0822fb5a348773e76a2b06ab9028997578c3f1c86121 On require of this package, index.js loads bootstrap.js which downloads a platform-specific executable over HTTPS from a rotating list of...

MAL-2026-13056 Malicious code in boxy-make-tokens-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3b24115f2a42bc7aa25741e66f56e8007a3d0816cab809e1da78740f9a7a2d5 index.js unconditionally requires./loader on module load. loader.js reconstructs three Cloudflare Worker hostnames oob-worker.cf99-9b3.workers.dev,...

Malicious code in boxy-maker-sticky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc3701b8f91a045a21b2a07ba76082afea03e4aea2c9a87a1c1e40e2de88c3b0 On require of boxy-maker-sticky, index.js loads runtime.js which reconstructs C2 hostnames from split string fragments...

Malicious code in boxy-maker-wave (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e064a8b2cd4e63ee24471673e5ac8f3cfb9ffae86a7e05eae7562395c3716b4 On require of the package, index.js loads platform.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from Cloudfla...

Malicious code in cardsmobile-data-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5f06952752248dcbd4411398f97014f1fd133db0cb66bfeb2b7121a4f974feb On require of cardsmobile-data-utils, index.js loads./vendor.js, which downloads a platform-specific native executable over HTTPS from hardcoded...

MAL-2026-12565 Malicious code in checkout-get-pos-documents-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0df9be66ed22c321db8a9a0eace4736f23ed1f2d9b5cd0a28e8bbc38c7163098 On any require/import of checkout-get-pos-documents-am, index.js loads compat.js, which selects a per-platform binary linuxx64, linuxarm64, darwin,...

Malicious code in claims-get-indexed-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe924c35590524d1632020cce8e08d68b232aa0d53b0f0ecb730f3ae87e07c35 [email protected] executes a binary dropper on module load. index.js unconditionally requires polyfill.js, which reassembles network...

MAL-2026-12621 Malicious code in claims-get-indexed-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe924c35590524d1632020cce8e08d68b232aa0d53b0f0ecb730f3ae87e07c35 [email protected] executes a binary dropper on module load. index.js unconditionally requires polyfill.js, which reassembles network...