MAL-2026-15969 Malicious code in array-frames (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9461945c1bccc858c52f79e13624b33fb8cdfc37c889de48907b8464779063 The npm package [email protected] advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload as its main module. On...

Malicious code in dolyame-ui-checkablegroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff93de8eda70052b857d953b6087515b34e3ae34d7269e410f6e07b181977d97 The package presents itself as a UI checkable-group helper but on require executes a dropper. helpers.js and the main-exported lib/telemetry.js...

MAL-2026-13582 Malicious code in dolyame-ui-inputsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0146bdcb21ca52b35e8a6f3ca19b7203b1fb5a456eb9dff6ace2eb60348333fe [email protected] is a dropper disguised as a UI input search component. On require, index.js loads./vendor.js, which assembles a mirror...

MAL-2026-13509 Malicious code in dolyame-ui-lazyrender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c406cc7b4d53676142db46c19a3e19211a3cc22fb01da79482ccb08cdddf419 On require of dolyame-ui-lazyrender, helpers.js selects a platform-specific binary path, fetches bytes over HTTPS from string-split-obfuscated...

Malicious code in devplatform-react-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21349fd06b973a43dd3b8e7bbf1ec9c726d71fba81e1656410d718a3ef4b7e7e [email protected] is a dropper disguised as a React MCP SDK. On require, index.js loads helpers.js which assembles three Cloudflare Worker...

Malicious code in eacq-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af2bcb4382f02a977f8448ea4f0172253035755b2d1dc363cce80f0389a1ee70 [email protected] contains a dropper reachable both from setup.js and from the main-exported lib/telemetry.js loaded on require'eacq-dialog'. The co...

MAL-2026-13166 Malicious code in dolyame-ui-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e3316d577d11997d6d21e26dc346cf8f3cdb986d4e61d7ac95dac0c3eda7ba On require'dolyame-ui-loader', index.js triggers shim.js which selects a platform-specific binary path, downloads a binary over HTTPS from one of...

MAL-2026-12838 Malicious code in bigops-tcrm-identity-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 183fa24523e19286718ff854ed8d080c8d8635d6d914a3fbb871c388660fc479 [email protected] is a dropper disguised as a session-management utility. Its main entry index.js requires bootstrap.js on load, which...

MAL-2026-12844 Malicious code in bigops-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d39f8f76c66cd667590e9159602b8c4ce9172a84fdf859f0b11fb862efb068b2 On require'bigops-timeline', index.js loads helpers.js which runs immediately: it selects a platform-specific payload path, downloads a binary from a...

Malicious code in bnpl-blocks-desktop-bnpl-header-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1af1b8630f713bc29fd99f332ba8035b26022f01199e755f2909d3440019fff On require of the package, index.js loads adapter.js whose top-level main constructs Cloudflare Workers hostnames oob-worker.cf100-3-.workers.dev and...

MAL-2026-13005 Malicious code in bnpl-blocks-mobile-bnpl-shopping-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a04004bb44c701e1976ef3d6678efb4cd9668d5a4986937c62928d1345550a86 On require of this package, index.js loads polyfill.js which selects a platform-specific download URL, reconstructs hostnames via array.join...

Malicious code in bnpl-blocks-mobile-bnpl-shopping-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a04004bb44c701e1976ef3d6678efb4cd9668d5a4986937c62928d1345550a86 On require of this package, index.js loads polyfill.js which selects a platform-specific download URL, reconstructs hostnames via array.join...

MAL-2026-13029 Malicious code in boxy-add-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8db319ad6492fd57275dc7c83a5a65815e17d2c39fb3daf395bb299742c14701 On require'boxy-add-link', index.js loads compat.js whose top-level bootstrap selects a platform-specific payload URL from string-split-obfuscated...

MAL-2026-13026 Malicious code in bnpl-molecule-mobile-bnpl-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf9828096a3c18e00ad577689ebcf4e4fa304a8702db4a0993063c95182530e On require of the package, index.js loads adapter.js, which runs an asynchronous dropper: it selects a platform-specific asset, downloads an executab...

Malicious code in boxy-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d0a7cd9dacffcb1188a7f6dfdde918d6ef5ba334e773f44330c93f4dd38ddf On require of the package, index.js unconditionally loads runtime.js, which fetches an OS-specific binary from attacker-controlled hosts under...

MAL-2026-13099 Malicious code in boxy-wrapper-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50 The package's main entrypoint index.js unconditionally requires./compat.js, whose top-level main reconstructs obfuscated Cloudflare Workers hosts...

MAL-2026-12548 Malicious code in checkout-commit-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...

Malicious code in checkout-get-installment-client-agreement-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c89ae5bb381502715feea1642012fc1c9b388a46746b357a6d8f1348e876c9 On require of the package, init.js detects the host OS and architecture, assembles Cloudflare Workers hostnames from split string fragments e.g...

MAL-2026-12578 Malicious code in checkout-mobile-pay-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57c8ea8352e1550f445ade3ea180ed272af5e77663f68d6d65ca9c90891d451f [email protected] is a dropper disguised as a mobile-payment/native-bridge SDK. On require of the package, index.js unconditionally...

MAL-2026-12595 Malicious code in checkout-test-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8dff84319052d8da1a322df80332f9d197a3e646f17c15b2fb5b53121f27dc0 On require of the package, index.js loads./runtime.js which unconditionally fetches a platform-specific executable from attacker-controlled Cloudflar...