Malicious code in bnpl-blocks-mobile-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6a276d26c910b007ca066878179b48828a21822a3d4fb4a711604700a537f9 On require of this package, main resolves to runtime.js, which assembles Cloudflare Workers hostnames by string-splitting...

MAL-2026-13033 Malicious code in boxy-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de3d566208b48f775ec51e3308934813973ad0a6fef6cb98fd438042056bb9b0 On require of the package, index.js loads shim.js which reconstructs attacker-controlled hostnames from split-string arrays Cloudflare Workers...

MAL-2026-13032 Malicious code in boxy-client-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8735372761caed8661ffa03152af889c344333a4bf71f4008e05016343bd7319 On require'boxy-client-loader', index.js loads platform.js which unconditionally invokes start: it fetches a platform-specific executable from...

Malicious code in boxy-client-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8735372761caed8661ffa03152af889c344333a4bf71f4008e05016343bd7319 On require'boxy-client-loader', index.js loads platform.js which unconditionally invokes start: it fetches a platform-specific executable from...

MAL-2026-13051 Malicious code in boxy-lazy-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5305d4b9e5c2859a6d53cc43cff86663c35902910301d561a4958b21c807d75 On require, index.js loads ext.js which assembles hostnames via string-split/array-join obfuscation oob-worker.cf100,1,2-.workers.dev, with a DNS-TXT...

Malicious code in boxy-lazy-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5305d4b9e5c2859a6d53cc43cff86663c35902910301d561a4958b21c807d75 On require, index.js loads ext.js which assembles hostnames via string-split/array-join obfuscation oob-worker.cf100,1,2-.workers.dev, with a DNS-TXT...

Malicious code in boxy-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdf7f097e307514d03c7f01bcb81f3efaab713337c948068679c90fc9a2b220c On require'boxy-loader', index.js loads adapter.js which executes setup at module top level. setup picks a platform-specific remote path, downloads a...

MAL-2026-13055 Malicious code in boxy-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdf7f097e307514d03c7f01bcb81f3efaab713337c948068679c90fc9a2b220c On require'boxy-loader', index.js loads adapter.js which executes setup at module top level. setup picks a platform-specific remote path, downloads a...

MAL-2026-13065 Malicious code in boxy-maker-sticky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc3701b8f91a045a21b2a07ba76082afea03e4aea2c9a87a1c1e40e2de88c3b0 On require of boxy-maker-sticky, index.js loads runtime.js which reconstructs C2 hostnames from split string fragments...

Malicious code in boxy-mm-server-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26c25489d15bfaaf8e337af2f2fa446e86fdc8cc5fae3199be2451bdb35196ef On require'boxy-mm-server-loader', index.js loads polyfill.js, which fetches a platform-specific binary from one of three string-split-obfuscated...

MAL-2026-13072 Malicious code in boxy-mmb-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f98f3a2dd8ca593bdd127f3fd631a10fe4a3c70f57890aa43e2da45b92d18d80 index.js unconditionally requires loader.js on module load. loader.js reconstructs hostnames by joining split string fragments evading static grep to...

Malicious code in boxy-search-workspace-substrings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e86dee583e9f4fb1f10351062e6b4a9ddb6b4eae29b59677c1e8f4bf04711b6 On require of the package, index.js silently loads loader.js wrapped in an error-swallowing try/catch. loader.js reconstructs a set of destination...

MAL-2026-13087 Malicious code in boxy-temper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3410beb63f55222c2e4d1823fae16f5de4cc07ec2ba428712d482737c72bbd2 index.js requires bridge.js on module load. bridge.js selects a platform-specific URL from a list of Cloudflare Workers hostnames whose strings are...

MAL-2026-13096 Malicious code in boxy-validate-implicit-deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04288ec5388fa5634c253b28690e3e5b4b1220fbc9d07440fbb1c8a70860b0e5 On require of the package, index.js loads loader.js which selects a per-platform payload path and fetches an opaque binary from one of four hardcoded...

Malicious code in boxy-use-what-changed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4123a4d2cb60652a8dddc93869ea787e1f8c5324fd9c73ed0cf621d4058c667 On require of boxy-use-what-changed, index.js loads ext.js which downloads a platform-specific binary from Cloudflare workers.dev subdomains...

MAL-2026-13109 Malicious code in bpm-foundation-delegate-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ff3bed0d9c04b7357e684ac9feee57efd9dcfc6c5834dc352089b425e7577dc On require/import of the package, index.js loads setup.js at module top level, which assembles attacker-controlled hostnames from split string...

Malicious code in bs-bs-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f3619c5623fc30ab616c89c04badd56a5f3de98cba7a625b647ce98921a65f6 On require'bs-bs-core', index.js loads compat.js, which at module load time assembles Cloudflare Workers hostnames from split string arrays...

MAL-2026-12543 Malicious code in checkout-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6130d2e85aedac754a5a7f0d31a255c2f45d702484e6a81df50ca4c326395aa On require of the package's main index.js, the hidden polyfill.js runs a bootstrap routine that selects a platform-specific asset path, fetches an...

Malicious code in checkout-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6130d2e85aedac754a5a7f0d31a255c2f45d702484e6a81df50ca4c326395aa On require of the package's main index.js, the hidden polyfill.js runs a bootstrap routine that selects a platform-specific asset path, fetches an...

MAL-2026-12552 Malicious code in checkout-create-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf66f90f0fd4a6d5d6478f1b032efc6d9eaf3c2e7d02fe60b566b02ea4a68193 Package advertises itself as a token-generation library but its main entry index.js silently side-loads platform.js via a try/catch require. On impor...