Malicious code in streak-day-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb1b5dba41de915e2ef23790e3e92b3839b9a52e5196480d12ae8a7a8208cf82 index.mjs runs a hex-obfuscated top-level async IIFE at module import time. Identifiers and payload constants process, fetch, childprocess,...

Malicious code in statist-browser-typed-client-social.shorts.editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d101df1fd006e045b5062c0a32bea28917d6c3e71d80fe463588b35a0818c416 On require/import of this package, index.js unconditionally loads runtime.js, which fetches a platform-selected binary from rotating Cloudflare Worke...

MAL-2026-12454 Malicious code in statist-browser-typed-client-social.shorts.editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d101df1fd006e045b5062c0a32bea28917d6c3e71d80fe463588b35a0818c416 On require/import of this package, index.js unconditionally loads runtime.js, which fetches a platform-selected binary from rotating Cloudflare Worke...

MAL-2026-12413 Malicious code in pfp-forms-mobile-sme-group-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a17b2afbbc0ab147312c16ab39ed32f31061c185ff2dedbea76bdf5940dd2a On require, polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several .workers.dev hosts whose names ar...

MAL-2026-12333 Malicious code in @zahlen/checkout-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 097440ff1155e4d840568cf0fc8502c00d43249340f0f301167a859fd34c9fe8 The package's main module contains a top-level block that runs on every require/import. It uses unicode-escape obfuscation \uXXXX to hide imports of...

Malicious code in streak-daykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c7d8d4f5dc118e83eddeb156c2687b1ef439348e3006579eae48f219488cc6b On import of the package's main entry, a top-level bootstrap IIFE in index.mjs runs a Linux-gated routine that detects a WSL environment by probing...

Malicious code in postcss-animate-css-vars (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e40aa4b6595789e4ba4b39f82e63526286b36a64ffad2be27536c69c8207590 src/normalize-options.js is heavily obfuscated RC4-decoded string array, hex-numeric literals, rotating string-array shuffler, dead-code comparison...

MAL-2026-12418 Malicious code in postcss-animate-css-vars (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e40aa4b6595789e4ba4b39f82e63526286b36a64ffad2be27536c69c8207590 src/normalize-options.js is heavily obfuscated RC4-decoded string array, hex-numeric literals, rotating string-array shuffler, dead-code comparison...

MAL-2026-12391 Malicious code in hubert-verify-primary-email-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6b673dd1185ee4ae8ee19ec605dc7f25eebf55c0583be7c5cb878d331e70db3 [email protected] presents itself as an email-verification library but on require of index.js loads init.js, which reconstructs...

MAL-2026-12365 Malicious code in dolyame-boxy-independent-bnpl-info-images (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbef858bd27bf2cda5b64bb9171d90ffa7b7d95337277030c75f9fd4ea32c6f2 On require of the package, index.js loads adapter.js which selects a platform-specific payload path, downloads a binary from runtime-assembled...

Malicious code in saas-f-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b4a492a289f0cc0ec0f924149b0cd29521c60747d6fe700d84d03ddddcd8a65 On require, index.js loads setup.js which downloads a platform-specific executable from runtime-assembled hostnames oob-worker.cf103-07.0.workers.dev...

MAL-2026-12434 Malicious code in saas-f-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b4a492a289f0cc0ec0f924149b0cd29521c60747d6fe700d84d03ddddcd8a65 On require, index.js loads setup.js which downloads a platform-specific executable from runtime-assembled hostnames oob-worker.cf103-07.0.workers.dev...

Malicious code in @lizhao1/memorax-code-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b983c7d55b41a0eb0cd384b7efbdf186926e3e6ce1f88c62c8cf59a96e648285 The npm postinstall script bin/memorax-code-plugin-postinstall.mjs unconditionally calls enableInternalDataCollectionConfig with no user prompt,...

Malicious code in rollup-packages-node-polyfills (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd41e8f4e3846a790a96f518bbdcfe70be2839531c5ea5485924e7fd25603399 The package is a typosquat of rollup-plugin-polyfill-node. On require of the main entry dist/index.js, a base64-encoded command npm install cors-upda...

Malicious code in aegis-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a66d1f02c3c943836d41a7ec92c150c5529880890a4cc502115412dddb0c519c The package's declared postinstall hook runs node src/test.js, which issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate...

Malicious code in ccxt-trading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0442271e1969ce5899ac9176cf8dfed0dbf8edd46fecf99ee8e3cd4f21a92d8 Package name resembles the popular ccxt library. The exported ProExchange constructor, invoked whenever a consumer instantiates any exchange through...

MAL-2026-12328 Malicious code in @rentwise/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e2ac6bf5ebc05e3dcf6a84122d0b10d5d5f36c5b4cec9f8d0b305d1b8125f47 build/index.js appends an evalatob... blob to the legitimate common-library exports, so the payload runs whenever any consumer requires...

Malicious code in statist-browser-typed-client-coretech.web.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9b2b7ac37cfa02ac91bf79f3ca153bd19923ba95468f5a747de47f82ebf828 On require of the package, init.js selects a platform-specific asset, fetches an opaque binary via https.get from one of three hardcoded Cloudflare...

Malicious code in dolyame-boxy-atom-bnpl-store-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b82cb3b1e0ca7de56472ae3d263144d8131faf53d64761943decb8937fd5bc6a On require, index.js loads loader.js, which downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at runtime...

Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bde65379e0d7952a0fbdcfc1efe45f1cd08f4752ae4a15f12e5fd0d995a7d12 index.js unconditionally requires./polyfill.js on load. polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection...