Malicious code in bigops-api-customer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41f35d0e9c1c32b6937135731889f5494483108bf0cf449fc19e5b4cecc4a002 On require of bigops-api-customer, index.js loads compat.js which downloads an OS-specific native binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12848 Malicious code in bigops-tslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6335298379affbc02ca5288e29777324f4d13ddec51b21ce999bb6eeda3996f The package advertises itself as a lint tool but its index.js unconditionally requires./ext, which on load selects a platform-specific payload path,...

MAL-2026-12895 Malicious code in bnpl-blocks-atom-bnpl-star-rating (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06bdc5da391bdf16afb2eb1cc60461831dc1d7ede9fa817cc842795cb8d2ddda On require of the package's main entry, index.js loads shim.js which fetches a platform-specific binary payload dotnetdiag.exe on Windows, loadermac...

Malicious code in bnpl-blocks-desktop-bnpl-grid-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f6433a65cdc6a8c5ce6486234ee3b6a17842ff9b51a9c33448a3dcf9dfcfd4d index.js unconditionally requires./setup.js, which on module load selects an OS/arch-specific asset path and downloads a binary from Cloudflare Worke...

MAL-2026-12932 Malicious code in bnpl-blocks-desktop-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e0ae14a5603433798af1dda72f0e9c1ae60505afa9205177c558c208d362b5e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

MAL-2026-12964 Malicious code in bnpl-blocks-independent-bnpl-origination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7441b8e4b9daaaa54b9963006ffa7868dc6f2d7ffaa65b4c11a029c43240dde1 On require of the package's main entry, runtime.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at...

Malicious code in boxy-lcd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c7174f43951c87b6b7ffb67430170a9b655978a1fe64654729c87fe35ced60 The package's index.js top-level requires setup.js, which on load fetches an OS-specific executable from string-concat-obfuscated Cloudflare Workers...

Malicious code in boxy-legacy-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8102d4aaa8c2a93380336ea524f83a3025cd00c71104060245f2143ba1b2694e On require of the package's main entry, index.js loads shim.js which unconditionally executes a dropper: it selects a platform-specific payload,...

Malicious code in boxy-render-unwrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26755161d9a2ac85d670783fc7eb67383b08592dbb67899b916d3e521d560420 On require of boxy-render-unwrap, index.js loads bootstrap.js which selects a platform-specific payload URL from a set of obfuscated mirror hosts...

MAL-2026-13075 Malicious code in boxy-pkg-deps-hash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1da74d1d4290df1bf3113989f436e444b8596103ce2a703bb0d6bcbbcff44e0a On require of the package, index.js loads adapter.js and unconditionally invokes setup. setup downloads a platform-specific binary from hardcoded...

MAL-2026-12577 Malicious code in checkout-mobile-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c9d5aebe1a3868e44878f382e7dfd21bcbebf8767f3ff0890b2d6330726f945 On any require/import of this package, index.js loads init.js, which selects a platform-specific endpoint and downloads an opaque binary from...

MAL-2026-12586 Malicious code in checkout-post-installment-client-agreement-accept-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3562600b17ec6918b0ebfda948a4579addb4bf1d55a39c696bf6b10fcc15020f On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev...

MAL-2026-12604 Malicious code in claims-accounts-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a3c4efb40a47a58bad33fece7aad0799560c3af1722173078224d0f1c3ec7f index.js unconditionally requires./setup.js when the package is loaded. setup.js selects a platform-specific endpoint, downloads bytes from a rotated...

Malicious code in cobrowsing-cobrowsing-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c27e38e295cce55b33b75d72a22db6deb6a851e7739111a1979f8317961465b9 [email protected] is a binary dropper disguised as a platform core package. On require/import index.js loads polyfill.js, the package...

Malicious code in constructor-blocks-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96701ff9ef8e8d7ed9b946a9cb3cc7efa18a6159a1729610892fb95dc6175c31 On require of constructor-blocks-common, index.js loads helpers.js which invokes a bootstrap routine at module load. The routine reconstructs...

Malicious code in delivery-ci-pipeline-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48367fe7933e3c07d664eda305a21bd8de43e06c685170b2146da16249bde15c index.js unconditionally requires init.js on load. init.js assembles attacker-controlled hostnames from split string fragments joined at runtime e.g...

Malicious code in devplatform-spa-plugin-ability (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9753b327ec0ed7c7cf204951dd0c1db47db31c79fde8ffad042e8658bb0dc81 On require of the package, index.js loads bootstrap.js which downloads a platform-specific native binary from anonymous Cloudflare Workers hosts...

MAL-2026-12790 Malicious code in glia-functions-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24f6c700225d22dcccdf1af7bb58c7628366ccc59b864431af5123909b42626 package.json's preinstall hook runs index.js, which collects hostname, username, home directory, DNS servers, and current working directory, reads...

Malicious code in technical-challenge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6921f72a1b4fbaaba87fcbe3cb30137815e7e2bb932ffa794acd0010b8954c5f package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects installer-side data —...

MAL-2026-12800 Malicious code in sc-font-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b8c91edd839dd00f2e58ad9296742f8c3c5ff126523bbd8ed7561fef7c8516e The package's preinstall script runs automatically on npm install and collects installer-side identifiers — os.hostname, os.userInfo.username,...