Malicious code in devplatform-spa-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428 On require, vendor.js selects a per-OS payload URL, fetches a binary from rotating .workers.dev hosts with a DNS-TXT base64 fallback via .dl.wel1.ru,...

MAL-2026-13262 Malicious code in devplatform-spa-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fffe57b043e47164a9c84d67bd7966a487e721806e019349a157b5b0f1d2e428 On require, vendor.js selects a per-OS payload URL, fetches a binary from rotating .workers.dev hosts with a DNS-TXT base64 fallback via .dl.wel1.ru,...

Malicious code in devplatform-spa-plugin-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca84ec076b60ced1412d45476eb90fb5c797b8dd53a5151d474dc979a085565 [email protected] is a binary dropper. index.js unconditionally requires shim.js, whose top-level init fetches a platform-specific...

MAL-2026-13260 Malicious code in devplatform-spa-plugin-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca84ec076b60ced1412d45476eb90fb5c797b8dd53a5151d474dc979a085565 [email protected] is a binary dropper. index.js unconditionally requires shim.js, whose top-level init fetches a platform-specific...

Malicious code in devplatform-supafetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dc92f63aa9d199fde2a42c1298a9c620b5823b5252d16c9450456e5efbb154d [email protected] is advertised as a fetch helper but on require drops and executes an opaque native binary. index.js unconditionally...

MAL-2026-13273 Malicious code in devplatform-vite-plugin-gle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81ba08fb4c9c52336f51b45ebe9089ba0b441f3da79529ac1c56f146d71861b6 On require, support.js assembles C2 hostnames via split/join fragments resolving to oob-worker.cf100-416.workers.dev, cf103-070.workers.dev,...

Malicious code in devplatform-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated...

Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

MAL-2026-13283 Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

Malicious code in devplatform-ui-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74230ed898152bc75d702938fcac9bd53e13ff7100120b44c5944bb8226225f7 index.js unconditionally requires./compat on load, which selects a platform-specific asset path linux/darwin/win32 and downloads bytes over HTTPS fro...

MAL-2026-13270 Malicious code in devplatform-ui-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74230ed898152bc75d702938fcac9bd53e13ff7100120b44c5944bb8226225f7 index.js unconditionally requires./compat on load, which selects a platform-specific asset path linux/darwin/win32 and downloads bytes over HTTPS fro...

Malicious code in devplatform-vite-plugin-preserve-css-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0781a29416d218a9767f37894e3ad9a851110f50693a4bcb1ab6bd168e1f6feb On require of the package, index.js loads loader.js which selects a platform-specific endpoint, downloads a native binary over HTTPS from...

Malicious code in docsmate-docsmate-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev and siblings cf100-416, cf101-adf,...

Malicious code in devplatform-zod-wip-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2629721fa3107222cef1f1669d474e7b3b45346ed87a455a168c1d199d9c6492 [email protected] is a typosquat/lookalike of the zod ecosystem that acts as an import-time dropper. index.js unconditionally...

MAL-2026-13279 Malicious code in docflow-cryptopro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b838ab488feb43fe2b50d6cd00579d3c1528877ea84d935ca89d8d863528bd25 On require of the package's main, platform.js downloads an opaque platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames...

Malicious code in dolyame-boxy-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7992916c62a9926f06f313367b6b684674413ecac4fe8cf1e0130165ae651fc7 On require of the package, index.js loads adapter.js, which downloads a platform-specific native binary from hardcoded destinations assembled via...

Malicious code in dolyame-boxy-atom-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26bfa012ebc79b0bf89d9eff7b1b0279bba4df11c76f80f6e81171f67d0dd7e5 On require, compat.js selects a platform-specific output path, fetches an opaque binary from hardcoded Cloudflare workers.dev subdomains assembled at...

MAL-2026-13289 Malicious code in dolyame-boxy-atom-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26bfa012ebc79b0bf89d9eff7b1b0279bba4df11c76f80f6e81171f67d0dd7e5 On require, compat.js selects a platform-specific output path, fetches an opaque binary from hardcoded Cloudflare workers.dev subdomains assembled at...

MAL-2026-13288 Malicious code in dolyame-boxy-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfa5d8518650ddd83b31e9587264a2ed049a47db5c8452af6d62eb50e9fa336 On load, index.js requires./loader.js which reconstructs anonymous host names via array-join obfuscation...

Malicious code in dolyame-boxy-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfa5d8518650ddd83b31e9587264a2ed049a47db5c8452af6d62eb50e9fa336 On load, index.js requires./loader.js which reconstructs anonymous host names via array-join obfuscation...