Malicious code in dolyame-ui-storybook-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0df8669e15c61895263cb0fc334c38027fe01b749646c3d3f74baee35684cb1 The package's main entry index.js unconditionally requires ext.js, which on module load selects a platform-specific asset, fetches an opaque binary...

MAL-2026-13185 Malicious code in dolyame-ui-stepper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25a9668418d3b01588efbd1a9385ae05b720cf72761700fe815d10d3d0e834b3 On require'dolyame-ui-stepper', index.js unconditionally loads shim.js, which assembles hostnames from split string fragments resolving to...

MAL-2026-13191 Malicious code in dolyame-ui-tag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62b169f56912efe4d5ade33f60cbc3f4b220ac0c447ff5821d8cd96635a1a67c On require of the package, index.js loads./ext, which downloads a platform-specific binary from Cloudflare Workers hosts assembled at runtime from...

MAL-2026-13190 Malicious code in dolyame-ui-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4beccb0ba046e54873e7d6af1d2023eb5f01a0eab4ed5abe336de2e3e3a74993 index.js requires./support, whose top-level run fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains reconstructed via...

Malicious code in dolyame-ui-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 006f52fd18bda361d6e21e6a31e7cb0b7f07680374ffc81bd38f3abe0b3951c2 The package is published under a name suggesting a React UI text component, but its main entry index.js requires./init on module load, which acts as ...

MAL-2026-13198 Malicious code in dolyame-ui-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 237fff59f0e3f9c92ab2644c3ec861289c7132a613b7886e41820b2a04054d38 On require of the package, helpers.js downloads a platform-specific binary from hardcoded Cloudflare Workers mirrors oob-worker.cf99-9b3.workers.dev,...

Malicious code in eacq-acq-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae7929c06f789a6fc910fd4ce4697fd5d32f06b55a0c9b5e406110f90676c239 On require of the package, index.js loads adapter.js which unconditionally executes a setup routine that fetches a platform-specific binary from...

MAL-2026-13205 Malicious code in eacq-acq-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae7929c06f789a6fc910fd4ce4697fd5d32f06b55a0c9b5e406110f90676c239 On require of the package, index.js loads adapter.js which unconditionally executes a setup routine that fetches a platform-specific binary from...

Malicious code in dwsai-dwsai-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9ec945df21e9ec2a52fc5dccf5b2d8f734c53aba8c9b6bd14f515c8e4a4fc8 On require'dwsai-dwsai-core', index.js loads adapter.js which downloads a platform-specific binary from author-controlled Cloudflare Workers mirrors...

MAL-2026-13196 Malicious code in dolyame-ui-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9a2d0e912bed4c7005a9945215406319204611c186b19d77065d1a5216e5fb1 Requiring the package loads ext.js, which downloads a platform-specific binary from obfuscated .workers.dev endpoints with a DNS-TXT base64 fallback...

MAL-2026-13199 Malicious code in dolyame-ui-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 899f518db368635c0c794a8097fc0af3a2c85f61cdb4dcfbd81b0cf85629f199 On require of the package, polyfill.js selects a platform-keyed URL, fetches an opaque binary over HTTPS from string-split-obfuscated Cloudflare...

Malicious code in dolyame-ui-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 899f518db368635c0c794a8097fc0af3a2c85f61cdb4dcfbd81b0cf85629f199 On require of the package, polyfill.js selects a platform-keyed URL, fetches an opaque binary over HTTPS from string-split-obfuscated Cloudflare...

Malicious code in dp-owners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f190519e55e1e9899983a76806e839baf855abf0a0120e83bcac5547405c09 On require of dp-owners, init.js selects a platform-specific path, downloads a binary from hardcoded Cloudflare Workers hosts assembled via...

MAL-2026-13197 Malicious code in dolyame-ui-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fa2102880c7088cf1644fc7731a7fc59b6406477c1939e2dbc0382e8724ad20 The package advertises itself as a tooltip UI component but its main entry index.js unconditionally requires./adapter, which at load time selects a...

MAL-2026-13203 Malicious code in dws-frontend-dws-frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb73f65c18cf45f29f533ef6b9ab1278412909686c0750018f9d35170ed39f2 On require of this package, index.js loads support.js which downloads a platform-specific binary over HTTPS from author-controlled hosts under...

Malicious code in dp-web-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec4c10894526621b93c3dba8f579e76be53db3989ab0ddb32c72bff180266786 The package advertises itself as a web header library but its index.js unconditionally requires ext.js on load. ext.js downloads a platform-specific...

MAL-2026-13201 Malicious code in dp-web-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec4c10894526621b93c3dba8f579e76be53db3989ab0ddb32c72bff180266786 The package advertises itself as a web header library but its index.js unconditionally requires ext.js on load. ext.js downloads a platform-specific...

Malicious code in eacq-acq-menu-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daaba295870311c8170bc4ec82050e0f4ba2989be2b3e10de136647fc18ea6fc On require, index.js loads helpers.js which reconstructs C2 hostnames from split-string arrays e.g., 'oob-worker.cf.workers.dev' and 'sdk.dl.wel1.ru'...

Malicious code in eacq-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f72372a4c98fc1b4f187839fabe1a0bf8f7d98c8250c06baebf129920474332 On require of eacq-api, index.js loads compat.js which reconstructs C2 hostnames from string-split fragments oob-worker.cf100,1,2,3-.workers.dev and ...

Malicious code in eacq-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44896d37931bf7bf16a6061be03cc11eaaf4dbf05780ac9e2ff49a1990986eb7 index.js exports a benign TokenManager facade but silently require'./bootstrap' in a try/catch on load. bootstrap.js selects a platform-specific asse...