MAL-2026-12712 Malicious code in devplatform-http-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0232efebd49d07216da6eabd594c614076a3d1b414417d0d1be86d547a9c1adc On require of devplatform-http-client, index.js loads vendor.js which unconditionally invokes init. The routine selects a platform-specific payload...

MAL-2026-12721 Malicious code in devplatform-npm-versions-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122 On require of the package, adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-npm-versions-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122 On require of the package, adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-12726 Malicious code in devplatform-nx-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07 The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires support.js, which fetches and executes an...

Malicious code in devplatform-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b21acc89730541bc58390e2694a9e5410417e5232bb4f4d47c0c27b035e2f4 Package is published as an i18n library but its main entry index.js requires./setup on load. setup.js selects a per-platform payload path, fetches...

MAL-2026-12713 Malicious code in devplatform-humanize-network-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d18ba9f3689dbc03127a3d82ffe0a6a2a15edf3e7f58b7ca9322499b2b68197 [email protected] advertises itself as a network-error humanizing utility, but on require its index.js unconditionally loads...

Malicious code in devplatform-humanize-network-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d18ba9f3689dbc03127a3d82ffe0a6a2a15edf3e7f58b7ca9322499b2b68197 [email protected] advertises itself as a network-error humanizing utility, but on require its index.js unconditionally loads...

MAL-2026-12731 Malicious code in devplatform-po-declaration-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3270e0e94deb3e2573594f28e84026653ee60f6c7f0a1fb79286ebba811ca525 On require, index.js unconditionally loads init.js, which selects a platform-specific binary for linux/darwin/win32, downloads it from Cloudflare...

MAL-2026-12742 Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

MAL-2026-12740 Malicious code in devplatform-react-rest-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 755ebe99a58cc94ddd8953897d01f30fcbacd145f6acf635761cf08b33d4868c On require of this package, index.js loads ext.js, which fetches a platform-specific binary from a rotating list of Cloudflare workers.dev hosts...

Malicious code in devplatform-react-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422556511a13a0424a33cfdb404a289d3fd51a0f7f206b4de8114fe69a0874b6 On require'devplatform-react-form', index.js loads adapter.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers...

Malicious code in devplatform-react-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15880efb2feec5e49ab725414e805293700e451ede11a2e4f3b1fe8e2f8f881c On require of the package, index.js loads helpers.js which reconstructs Cloudflare Workers hostnames via array-join string splitting...

MAL-2026-12744 Malicious code in devplatform-rest-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5813e9b97274c2eb3abd3459781550762baeea8c8fc0cec09603dac56a405d8 On require'devplatform-rest-client', index.js loads init.js which selects a platform-specific endpoint, downloads a binary from one of three Cloudfla...

Malicious code in devplatform-rest-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5813e9b97274c2eb3abd3459781550762baeea8c8fc0cec09603dac56a405d8 On require'devplatform-rest-client', index.js loads init.js which selects a platform-specific endpoint, downloads a binary from one of three Cloudfla...

Malicious code in devplatform-s3-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 618b016d2ee8f333f47ee78c4ffe29b703a08ab7fca524ee072944394fb1301c On require of the package's main entry, bridge.js assembles Cloudflare Workers hostnames from string fragments via Array.join e.g...

MAL-2026-12747 Malicious code in devplatform-s3-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 618b016d2ee8f333f47ee78c4ffe29b703a08ab7fca524ee072944394fb1301c On require of the package's main entry, bridge.js assembles Cloudflare Workers hostnames from string fragments via Array.join e.g...

Malicious code in devplatform-spa-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9cf6b251dcd1cb74d6b5dd84f62868d0213365ea555bbb8eb1d99dcdafedc26 index.js requires./polyfill on module load, which asynchronously fetches a platform-selected binary from runtime-assembled Cloudflare Workers...

MAL-2026-12755 Malicious code in devplatform-spa-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9cf6b251dcd1cb74d6b5dd84f62868d0213365ea555bbb8eb1d99dcdafedc26 index.js requires./polyfill on module load, which asynchronously fetches a platform-selected binary from runtime-assembled Cloudflare Workers...

Malicious code in devplatform-spa-plugin-location (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb9472f7623159163739228ed6ec07beb8599d3867f7c5215e4bf0e4bbde5a78 On require of the package, index.js loads vendor.js, which selects a platform-specific payload URL by joining string fragments to reconstruct...

MAL-2026-12770 Malicious code in devplatform-spa-plugin-location (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb9472f7623159163739228ed6ec07beb8599d3867f7c5215e4bf0e4bbde5a78 On require of the package, index.js loads vendor.js, which selects a platform-specific payload URL by joining string fragments to reconstruct...