Malicious code in dolyame-ui-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78e2cf3af799e05f20494aba04b5d85aa1335bce541af4cb13aa715a2cda6ea5 On require'dolyame-ui-dropdown', index.js loads helpers.js which selects a platform-specific endpoint from an obfuscated split-literal host list...

Malicious code in dolyame-ui-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15f91ac3c4278628875a5c009c515bcdb5fbc8b885eb32dff56e4367c5babf66 On require, index.js loads bootstrap.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints hostnames assembled at...

MAL-2026-13158 Malicious code in dolyame-ui-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 714598919807b4143a734772e690ff94aa986fb6cf61bd99026e7f7bc93f4cf2 On require of the package's main entry, loader.js runs a platform-detecting downloader that fetches an executable from obfuscated hostnames...

MAL-2026-13161 Malicious code in dolyame-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4668c9441e4f15054a71b066764259aac91f52c51e48ff2656a63c9a09f96e5d On require of dolyame-ui-island, index.js loads setup.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-ui-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9361a45d107dd4fff2e6928df78c74829cdb1e0c49f6fe513c60124331f8242 [email protected] is published as a React component library but ships no UI code. On require, index.js loads shim.js, which downloads a...

MAL-2026-13160 Malicious code in dolyame-ui-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9361a45d107dd4fff2e6928df78c74829cdb1e0c49f6fe513c60124331f8242 [email protected] is published as a React component library but ships no UI code. On require, index.js loads shim.js, which downloads a...

MAL-2026-13163 Malicious code in dolyame-ui-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f8bf970c387898705de052ea5736f3f90877cfcdad204af1a772b5230c95c31 On every require of dolyame-ui-layout, index.js loads platform.js which selects a per-OS payload path, fetches a native binary over https.get from...

Malicious code in dolyame-ui-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e3316d577d11997d6d21e26dc346cf8f3cdb986d4e61d7ac95dac0c3eda7ba On require'dolyame-ui-loader', index.js triggers shim.js which selects a platform-specific binary path, downloads a binary over HTTPS from one of...

Malicious code in dolyame-ui-label (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdcede6d4d42bfed7f10577346b24e9af22655e50f8d454baab6f4999e6020f3 dolyame-ui-label 35.7.8 is not a UI component library. On require of the package, index.js loads helpers.js, which reconstructs C2 hostnames at runti...

MAL-2026-13162 Malicious code in dolyame-ui-label (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdcede6d4d42bfed7f10577346b24e9af22655e50f8d454baab6f4999e6020f3 dolyame-ui-label 35.7.8 is not a UI component library. On require of the package, index.js loads helpers.js, which reconstructs C2 hostnames at runti...

MAL-2026-13171 Malicious code in dolyame-ui-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27d450fda6c199002bb4eb20b3bf624e31393ae3ed30e9a36fce17507472b962 Package advertises itself as a UI notification toolkit but its main entry requires./compat.js, which on load randomly selects a destination from four...

Malicious code in dolyame-ui-money (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df3e9dd433a891fcca85ed4a7302185b3eccece39df2db60ab540b0ebed8631b On require of this package, index.js unconditionally loads bridge.js, which downloads a platform-specific native executable from Cloudflare Workers...

MAL-2026-13169 Malicious code in dolyame-ui-money (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df3e9dd433a891fcca85ed4a7302185b3eccece39df2db60ab540b0ebed8631b On require of this package, index.js unconditionally loads bridge.js, which downloads a platform-specific native executable from Cloudflare Workers...

Malicious code in dolyame-ui-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26aae43ae2f260593e90c501c2863a515d4aa4f6753fccf82df101c62d43b77a index.js requires./loader on load. loader.js reconstructs attacker-controlled hostnames from split string fragments joined via.join"" to yield...

MAL-2026-13164 Malicious code in dolyame-ui-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26aae43ae2f260593e90c501c2863a515d4aa4f6753fccf82df101c62d43b77a index.js requires./loader on load. loader.js reconstructs attacker-controlled hostnames from split string fragments joined via.join"" to yield...

MAL-2026-13170 Malicious code in dolyame-ui-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4dd05e52eb6422332d1d846b689062b7bc9c38ec3393eed9919e6bed3c56a2 The package advertises itself as a UI navigation toolkit, but its main entry index.js requires./compat.js, which on load fetches a platform-specific...

Malicious code in dolyame-ui-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cecad37efa23b83ead95d73e1b0ef07dbb8473dfd76645f4ceed5cf7939653f4 The package is published as a React UI component library but on require'dolyame-ui-menu', index.js loads polyfill.js which fetches a platform-specifi...

Malicious code in dolyame-ui-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db9f072ffe296e46cc8e680613ad548ddea1174c0cc481272a564c85860bfdb4 On require of dolyame-ui-list, index.js loads vendor.js which downloads a platform-specific executable from one of four hardcoded Cloudflare Workers...

MAL-2026-13165 Malicious code in dolyame-ui-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db9f072ffe296e46cc8e680613ad548ddea1174c0cc481272a564c85860bfdb4 On require of dolyame-ui-list, index.js loads vendor.js which downloads a platform-specific executable from one of four hardcoded Cloudflare Workers...

MAL-2026-13168 Malicious code in dolyame-ui-mixins (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c202a6c0c4fddf77f53b3fc786c34627b47992e1f789701121793399dce47ebd On require of dolyame-ui-mixins, index.js loads./ext, which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32 and downloads ...