MAL-2026-12602 Malicious code in checkout-use-notifications (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a9b7cb00a4aac61795c81a085319cb8b0ac0aff1350a0dafddb4ef31d25a15f On require of the package, index.js unconditionally loads shim.js, which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in claims-handle-api-response (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c11d3c5993128f5cb1eafd05487aeb9f630aee5bdef132bcf3d4b07bdfebe3e The package advertises itself as a REST client wrapper but its main entry index.js requires./setup on load. setup.js selects a platform-specific URL,...

Malicious code in claims-policy-details-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddd2a9e4dd34aac1232648e9e5f459331bd73d0f3779ed68ac559d8f4692c9bb On require of claims-policy-details-domain, index.js loads vendor.js which downloads a platform-specific binary from anonymous Cloudflare workers.dev...

Malicious code in claims-policies-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d8ba02b55d458bc61e8bda89796763be5f0318df30b36dca5746990b9a578db On require of claims-policies-api-adapters, index.js loads vendor.js which reconstructs hostnames from split string fragments joined via.join'',...

Malicious code in constructor-blocks-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96701ff9ef8e8d7ed9b946a9cb3cc7efa18a6159a1729610892fb95dc6175c31 On require of constructor-blocks-common, index.js loads helpers.js which invokes a bootstrap routine at module load. The routine reconstructs...

MAL-2026-12710 Malicious code in devplatform-eslint-plugin-nx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35adb61664d8a7067c4ace2c143ed75e5e316dcd5365201ac8614ef9ff07e668 [email protected] is a typosquat lure targeting @nx/eslint-plugin. On require of the package, index.js loads runtime.js which...

Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

MAL-2026-12403 Malicious code in node-cache-multithread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09be7b43b4fe5e0c786fb116e4a99518c46825e2b18b5e65eca88c51470b07a0 index.js, the package's declared main entry, is a 23KB obfuscator.io RC4/base64 string-array bundle whose top-level IIFE runs on require. It requires...

MAL-2026-12380 Malicious code in fb-forms-form-boilerplate-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23bb3ca46733a388c550c5a1f6514c78b026447f355fcc669d1dfa0d58e8963a Package advertises itself as a form-boilerplate library but its top-level index.js unconditionally requires init.js, which on load downloads a...

Malicious code in hubert-react-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765788871d6200a403058846fe3599c2c59588a6b00efc9ee770d7d1501e1b74 The package's main entry index.js unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers hostnames from string-fragme...

MAL-2026-12129 Malicious code in accounts-appointment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b85924ae1e24ede2acf333de8af5ca1d8ae2854652be2b3b82a01df710adc27a index.js unconditionally requires./setup, which on load selects a platform-specific payload path, fetches bytes over HTTPS from Cloudflare workers.de...

Malicious code in tailwind-animate-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eb20d422c7053793a78e3d898bef2d97269318be88f147d60c7d036d2d23144 index.js appends a large base64-encoded, unicode-escaped payload after 11 KB of whitespace padding, executed via evalatob'...' whenever the package i...

MAL-2026-12269 Malicious code in tinkoff-statist-browser-typed-client-mb.reliability.android.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c12f5330c144cfe67198d49d442d702f5e40977e1d607ab651d33dffb2d073 index.js unconditionally requires./loader on module load. loader.js selects a platform-specific payload path for Linux/macOS/Windows, downloads a...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...