Malicious code in statist-browser-typed-client-coretech.web.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9b2b7ac37cfa02ac91bf79f3ca153bd19923ba95468f5a747de47f82ebf828 On require of the package, init.js selects a platform-specific asset, fetches an opaque binary via https.get from one of three hardcoded Cloudflare...

Malicious code in dolyame-boxy-atom-bnpl-store-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b82cb3b1e0ca7de56472ae3d263144d8131faf53d64761943decb8937fd5bc6a On require, index.js loads loader.js, which downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at runtime...

Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bde65379e0d7952a0fbdcfc1efe45f1cd08f4752ae4a15f12e5fd0d995a7d12 index.js unconditionally requires./polyfill.js on load. polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection...

Malicious code in travel-core-utils-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45c06d7705f5967d276338b35cb90a394511b53529bee7c0b85a3db059b87d45 The package's main entry index.js has a side-effect require of bridge.js, which on load selects a platform-specific asset, fetches an opaque binary...

Malicious code in pfp-block-mobile-steps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4b4495333f6f37664594f2e6533842a4d3a317bb98bbc3a467797bb8ec851d7 On require of the package, index.js unconditionally loads shim.js, which selects a payload path based on process.platform/arch linuxx64, linuxarm64,...

Malicious code in express-mongo-santi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose ...

MAL-2026-12488 Malicious code in tt-help-cli-ycl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6144be61d70f258741e5d4cc1476021f93e3ce82ffa00a3f86189537a1438a6 The package's tt-help watchdog subcommand starts a long-running agent that POSTs heartbeats to a remote server default hardcoded to...

Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e7b10d7a21e347dca99c9bf32f2c4d81aef8bdc78a10d308b63a881db69027 The package's declared main index.js unconditionally requires./init on load. init.js selects a platform-specific asset win32/darwin/linuxx64/linuxarm...

Malicious code in sme-auth-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3d46bc99b3f8904f9d24bfac1600b245fe39af77d713acf1ee761bb57212f3c On require'sme-auth-core', index.js loads init.js which platform-selects a URL and fetches an opaque binary from one of three string-obfuscated...

MAL-2026-12207 Malicious code in sme-auth-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3d46bc99b3f8904f9d24bfac1600b245fe39af77d713acf1ee761bb57212f3c On require'sme-auth-core', index.js loads init.js which platform-selects a URL and fetches an opaque binary from one of three string-obfuscated...

Malicious code in statist-browser-typed-client-ddp.mentat.ui.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dc78a545236395c12156cd5f8e36337df53024afd0a6a6da75f81fb9b7c11e7 The package's main entry index.js loads polyfill.js, which on module load detects OS and architecture, fetches a per-platform binary over HTTPS from...

MAL-2026-12209 Malicious code in statist-browser-typed-client-ddp.mentat.ui.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dc78a545236395c12156cd5f8e36337df53024afd0a6a6da75f81fb9b7c11e7 The package's main entry index.js loads polyfill.js, which on module load detects OS and architecture, fetches a per-platform binary over HTTPS from...

MAL-2026-12213 Malicious code in statist-browser-typed-client-mb.product.sme.cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70a2f91acb1c71608716269413dca908b94c890cd76146a377bb945a4b7e271c On require of this package, index.js loads ext.js which downloads a platform-specific executable from string-concatenated Cloudflare Workers hosts...

MAL-2026-12181 Malicious code in hubert-react-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765788871d6200a403058846fe3599c2c59588a6b00efc9ee770d7d1501e1b74 The package's main entry index.js unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers hostnames from string-fragme...

Malicious code in tailwindcss-scrollbar-hide (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1199d5059f205844a58fd599bb890d1056ea3127830ea4d6c13a7c08ffb6f6b9 dist/index.js appends evalatob'...' after the legitimate CSS-plugin export, so simply importing or requiring the package executes an obfuscated paylo...

Malicious code in twork-data-services-sme-agent-company-relation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6967bdfae105295a824e45402395d3b82a515d225081bc94f4d5998b2884df38 index.js unconditionally requires./init on module load. init.js assembles host names at runtime via array join to hide them from static scanners, the...

Malicious code in twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc9ecd33902db113f3bb6298959c7fdc62344f82c110421040ee470a59d0d060 On require of the package, index.js invokes setup in helpers.js which downloads a platform-specific native binary from split-string-obfuscated...

MAL-2026-12208 Malicious code in sme-scripts-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b75dc70e9ee97206f0c177de615ca37ed1611752e645127bc6961e5d753f61f On require'sme-scripts-cli', index.js loads bridge.js which detects OS/architecture, downloads an OS-specific binary from hardcoded Cloudflare...

Malicious code in scandoc-scandoc-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88040968dbf46cb6d8018a4c21563f6845140435ce3b93e69b0934a81a8a469b On require of the package, index.js loads vendor.js which fetches a platform-specific binary from Cloudflare Workers hostnames reconstructed at runti...

MAL-2026-12191 Malicious code in scandoc-scandoc-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88040968dbf46cb6d8018a4c21563f6845140435ce3b93e69b0934a81a8a469b On require of the package, index.js loads vendor.js which fetches a platform-specific binary from Cloudflare Workers hostnames reconstructed at runti...