MAL-2026-13028 Malicious code in boxy-adapter-tramvai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d20d5167abc8703b7b09a0d9698e6d0fd060f4378dfa11ab469af3e6805cfc8e On library load, index.js requires./runtime.js, which selects a platform-specific staging path, fetches an opaque binary from obfuscated Cloudflare...

Malicious code in bnpl-forms-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd6e149b86406225e3aca99e9bbae44cf13c0c7d5e10be27155162b63832f2f On require'bnpl-forms-test-utils', index.js loads platform.js, which selects a platform-specific endpoint and downloads an opaque binary via https.ge...

MAL-2026-13024 Malicious code in bnpl-forms-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd6e149b86406225e3aca99e9bbae44cf13c0c7d5e10be27155162b63832f2f On require'bnpl-forms-test-utils', index.js loads platform.js, which selects a platform-specific endpoint and downloads an opaque binary via https.ge...

Malicious code in bnpl-blocks-types-gen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de78304bd1becbc9d7c967d281a308b18da039554be722990596f528180454f5 On require'bnpl-blocks-types-gen', top-level code in index.js invokes setup in platform.js, which selects a platform-specific binary path, downloads...

MAL-2026-13021 Malicious code in bnpl-blocks-types-gen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de78304bd1becbc9d7c967d281a308b18da039554be722990596f528180454f5 On require'bnpl-blocks-types-gen', top-level code in index.js invokes setup in platform.js, which selects a platform-specific binary path, downloads...

Malicious code in boxy-docusaurus-plugin-content-docs-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 282deb7b97e943caa32f55b14ac302a247a129edb04419d744f01b62666beaae [email protected] executes a dropper on require. index.js loads ext.js, which reconstructs destination hostnames at...

Malicious code in bnpl-molecule-mobile-bnpl-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf9828096a3c18e00ad577689ebcf4e4fa304a8702db4a0993063c95182530e On require of the package, index.js loads adapter.js, which runs an asynchronous dropper: it selects a platform-specific asset, downloads an executab...

Malicious code in boxy-expander-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1f5856de3b0385535e80e5ef85627ecb7a087132c82c5d5457b35b62b9eaf72 On require of this package, index.js loads./runtime.js which assembles Cloudflare Workers hostnames via string-split.join'' fragments e.g...

MAL-2026-13043 Malicious code in boxy-expander-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1f5856de3b0385535e80e5ef85627ecb7a087132c82c5d5457b35b62b9eaf72 On require of this package, index.js loads./runtime.js which assembles Cloudflare Workers hostnames via string-split.join'' fragments e.g...

Malicious code in boxy-devtools-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 902a7b42df643551615d55958546ab9115082ac8eb60ff1208cafa18b804ab3c The package's main entry index.js unconditionally loads compat.js on require. compat.js assembles a rotating list of Cloudflare Workers hostnames...

MAL-2026-13039 Malicious code in boxy-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d0a7cd9dacffcb1188a7f6dfdde918d6ef5ba334e773f44330c93f4dd38ddf On require of the package, index.js unconditionally loads runtime.js, which fetches an OS-specific binary from attacker-controlled hosts under...

Malicious code in boxy-esm-shims (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8f8bbecdfed31ec416782f6de127cb1003692978560504d748acd121b30fa3b On require of the package, index.js loads vendor.js which fetches an opaque binary from string-obfuscated Cloudflare Workers hosts...

Malicious code in boxy-fixture-pendel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbad559799410017202aafce879de36d171f9480e4cd995e4e5fe5cb3bddb830 On require'boxy-fixture-pendel', index.js loads support.js which asynchronously downloads a platform-specific binary from obfuscated destinations...

MAL-2026-13046 Malicious code in boxy-fixture-pendel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbad559799410017202aafce879de36d171f9480e4cd995e4e5fe5cb3bddb830 On require'boxy-fixture-pendel', index.js loads support.js which asynchronously downloads a platform-specific binary from obfuscated destinations...

MAL-2026-13044 Malicious code in boxy-fixture (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb575dd1ac71dc5968106b313680bb84dd0d90172e82c1a79887b085ba55b4bd On require of the package, index.js loads support.js which executes setup at module load. The code reconstructs Cloudflare Workers hostnames...

MAL-2026-13047 Malicious code in boxy-fixture-pfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a15e41a397b63d04216419ddd8ec88f37cb68c5d35997ad840543e034f87d8f On require of the package, polyfill.js downloads a platform-specific binary from hardcoded destinations reassembled at runtime from split-string arra...

Malicious code in boxy-maker-page-readiness (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 273f130823f6759922a2e1d6f7c58ba24b9df17f7c08c6f6e43b0818b5aad4ed index.js unconditionally requires bootstrap.js on module load. bootstrap.js reassembles hostnames from split-string arrays e.g...

MAL-2026-13061 Malicious code in boxy-maker-page-readiness (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 273f130823f6759922a2e1d6f7c58ba24b9df17f7c08c6f6e43b0818b5aad4ed index.js unconditionally requires bootstrap.js on module load. bootstrap.js reassembles hostnames from split-string arrays e.g...

Malicious code in boxy-lcd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c7174f43951c87b6b7ffb67430170a9b655978a1fe64654729c87fe35ced60 The package's index.js top-level requires setup.js, which on load fetches an OS-specific executable from string-concat-obfuscated Cloudflare Workers...

Malicious code in boxy-live (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2804acf2e6e6e87de8651cf13574290daa1a3a59bb556d8f225d2d6d2abd8783 On package load, index.js requires loader.js, whose top-level start fetches a platform-specific unsigned binary from Cloudflare Workers hosts whose...