MAL-2026-12556 Malicious code in checkout-desktop-input-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 317938aa255d67b53270d9d65917205c21be71300549f7d023e1db92c3a07d70 On require of this package, index.js loads runtime.js, which selects a platform-specific endpoint, downloads a binary over HTTPS from runtime-assembl...

MAL-2026-12554 Malicious code in checkout-desktop-bnpl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd165a0865ff5e6b4a488e6a81018740deff0071604e6d06fff046d2c8a1b0a1 The package presents itself as a checkout/BNPL library but exports an empty CheckoutDesktopBnpl class with no BNPL functionality. On require of the...

MAL-2026-12557 Malicious code in checkout-desktop-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0 On require of checkout-desktop-legal, index.js loads compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare...

MAL-2026-12568 Malicious code in checkout-input-email-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f845143d537f4590a200285bce69801a27e5c73a1080212bae23c392c43841 On require, bridge.js assembles attacker-controlled hostnames from split-string fragments oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-dolyame-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf1762450e49c2a25e6765179edb585ba02fbc9375b72098fa0804ffae847ac2 On require of the package, index.js loads./runtime.js, which assembles mirror hostnames from split string arrays e.g...

MAL-2026-12562 Malicious code in checkout-dolyame-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf1762450e49c2a25e6765179edb585ba02fbc9375b72098fa0804ffae847ac2 On require of the package, index.js loads./runtime.js, which assembles mirror hostnames from split string arrays e.g...

MAL-2026-12566 Malicious code in checkout-iframe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 934be30452a9d059a8a51c5f53461099b248d3c91217f95b9fe5fe11c7981f87 On require'checkout-iframe', index.js loads platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in checkout-input-card-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cc552600295f6b008943a756a1cf29218d2e6d93a40dd72ea4cd06f039f80cb On require of the package, index.js loads vendor.js, which downloads a platform-specific binary from Cloudflare Workers subdomains...

Malicious code in checkout-mobile-dolyame (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd Requiring checkout-mobile-dolyame loads loader.js via index.js, which selects an OS/arch-specific binary and downloads it over HTTPS from obfuscated...

MAL-2026-12574 Malicious code in checkout-mobile-dolyame (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd Requiring checkout-mobile-dolyame loads loader.js via index.js, which selects an OS/arch-specific binary and downloads it over HTTPS from obfuscated...

Malicious code in checkout-mobile-input-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8121f8e2d367655a7ee2c6b8630e4e6210cee3b5ecded80de7e07f7dc61446e On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames...

MAL-2026-12575 Malicious code in checkout-mobile-input-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8121f8e2d367655a7ee2c6b8630e4e6210cee3b5ecded80de7e07f7dc61446e On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames...

Malicious code in checkout-mobile-cashback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82f24faec25bf10df39c7327ce852058d9c23bb9983dae0d4b28c3843f0997f4 [email protected] executes a staged binary dropper on module load. index.js requires./shim, which selects a platform-specific binary UR...

Malicious code in checkout-mobile-bnpl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0734507ccd6f61cb81c277d9e9215c90f0b8cff1bd16f0c3eacd399750d26b4f index.js requires./helpers on load. helpers.js reconstructs three Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

Malicious code in checkout-molecule-desktop-status-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247 The package's main entry index.js requires./polyfill on load. polyfill.js immediately runs an async routine that reconstructs several hostnames from...

Malicious code in checkout-pay-button-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d4bf54bc4e3750c7e9bc6ef385108c37ee00b486858c0576585ef2f88780385 On require, index.js invokes helpers.js which selects a per-OS payload path, fetches a native binary over HTTPS from string-split-obfuscated Cloudfla...

MAL-2026-12584 Malicious code in checkout-pay-button-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d4bf54bc4e3750c7e9bc6ef385108c37ee00b486858c0576585ef2f88780385 On require, index.js invokes helpers.js which selects a per-OS payload path, fetches a native binary over HTTPS from string-split-obfuscated Cloudfla...

Malicious code in checkout-mobile-total (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1943ab64ce84576c6fef87d3b46187d0e442941f691d645adfe5f73595cfe9a On require of the package, index.js unconditionally loads vendor.js, which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12580 Malicious code in checkout-mobile-total (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1943ab64ce84576c6fef87d3b46187d0e442941f691d645adfe5f73595cfe9a On require of the package, index.js unconditionally loads vendor.js, which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in checkout-molecule-mobile-status-sheet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d49254998829dd2e5809cd78290939f76e37c2c82dcb75d4331703522b95adb0 On require of this package, index.js unconditionally loads compat.js, which fetches a platform-specific executable from hardcoded Cloudflare Workers...