MAL-2026-13502 Malicious code in devplatform-react-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21349fd06b973a43dd3b8e7bbf1ec9c726d71fba81e1656410d718a3ef4b7e7e [email protected] is a dropper disguised as a React MCP SDK. On require, index.js loads helpers.js which assembles three Cloudflare Worker...

Malicious code in pfp-forms-sme-sitebuilder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f0c2b9f45c8e537bcf70d98c1aa5daa263962eae954c2d871d978e0ac0dd64 index.js unconditionally requires./support on module load. support.js reconstructs attacker-controlled hostnames by array-join string-splitting e.g...