MAL-2026-12991 Malicious code in bnpl-blocks-mobile-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f511a9eac93e0ef06eeec5ab7ec22330cb092c4fda952ec540f4a9be3fc522f On require of the package, index.js loads bridge.js which fetches an OS-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in bnpl-blocks-mobile-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f511a9eac93e0ef06eeec5ab7ec22330cb092c4fda952ec540f4a9be3fc522f On require of the package, index.js loads bridge.js which fetches an OS-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in bnpl-blocks-mobile-bnpl-image-with-caption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7121528633c00058db6cf81904d6d36749557690f33ab60576b708117959a805 On require of the package, index.js loads polyfill.js which selects a platform-specific endpoint and downloads a binary over HTTPS from one of three...

MAL-2026-12994 Malicious code in bnpl-blocks-mobile-bnpl-image-with-caption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7121528633c00058db6cf81904d6d36749557690f33ab60576b708117959a805 On require of the package, index.js loads polyfill.js which selects a platform-specific endpoint and downloads a binary over HTTPS from one of three...

Malicious code in bnpl-molecule-mobile-bnpl-onboarding (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23d110510740ced78dc5855c7f9c0c3dedff3669ad49cb52aeee3c5467f00d3b On require of the package, index.js loads runtime.js which selects a platform-keyed asset linux/darwin/win32, downloads an opaque binary from one of...

Malicious code in boxy-client-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8735372761caed8661ffa03152af889c344333a4bf71f4008e05016343bd7319 On require'boxy-client-loader', index.js loads platform.js which unconditionally invokes start: it fetches a platform-specific executable from...

Malicious code in bnpl-molecule-mobile-bnpl-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf9828096a3c18e00ad577689ebcf4e4fa304a8702db4a0993063c95182530e On require of the package, index.js loads adapter.js, which runs an asynchronous dropper: it selects a platform-specific asset, downloads an executab...

MAL-2026-13052 Malicious code in boxy-lcd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c7174f43951c87b6b7ffb67430170a9b655978a1fe64654729c87fe35ced60 The package's index.js top-level requires setup.js, which on load fetches an OS-specific executable from string-concat-obfuscated Cloudflare Workers...

MAL-2026-13085 Malicious code in boxy-story-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a1273cea6d0d4cdf432c47fda7e95f529858a1bddefaaeeb976248ea55504f2 index.js unconditionally requires./setup on load. setup.js reconstructs C2 hostnames by array-joining string fragments Cloudflare Workers subdomains...

Malicious code in boxy-story-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a1273cea6d0d4cdf432c47fda7e95f529858a1bddefaaeeb976248ea55504f2 index.js unconditionally requires./setup on load. setup.js reconstructs C2 hostnames by array-joining string fragments Cloudflare Workers subdomains...

MAL-2026-13119 Malicious code in bpm-foundation-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1e2729c7a957ee4366b693a24d178137743df7bf2ee5d65d3cecf3c8cfdc5f On require, index.js loads ext.js, which selects a platform-specific path, fetches an executable over HTTPS from string-concatenation-obfuscated host...

Malicious code in cards-forms-clone-cards-core-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74486d1afedd40c87c6d604f98ffda15100b2ee63af56e8f7330346d915269c9 On require, index.js loads platform.js, which selects a platform-specific asset URL from obfuscated hostnames assembled via split-then-join string...

Malicious code in checkout-promocode-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1d75e7966f60937203bdc9f6ee1a90e58fbf046f76ec5aa0b4d68018fce4f87 On require, index.js loads ext.js which selects a per-OS payload path, fetches an executable over HTTPS from string-concatenation-obfuscated hosts...

MAL-2026-12659 Malicious code in cobrowsing-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a369ea5eb28ebfd7fddb1c5baa3fc22fb371761839c0a2bd7123df273acd2077 [email protected] executes a binary dropper as a side effect of requiring the package. index.js loads helpers.js which auto-runs main at import...

Malicious code in cobrowsing-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a369ea5eb28ebfd7fddb1c5baa3fc22fb371761839c0a2bd7123df273acd2077 [email protected] executes a binary dropper as a side effect of requiring the package. index.js loads helpers.js which auto-runs main at import...

Malicious code in devplatform-react-micro-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38577b4e463996b1df19599f016c8ad16ebb36d8650effd666c93d844364c475 [email protected] is a lure package whose main entry auto-loads adapter.js on require. adapter.js selects a platform-specific...

MAL-2026-12737 Malicious code in devplatform-react-micro-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38577b4e463996b1df19599f016c8ad16ebb36d8650effd666c93d844364c475 [email protected] is a lure package whose main entry auto-loads adapter.js on require. adapter.js selects a platform-specific...

MAL-2026-12748 Malicious code in devplatform-s3-resources (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85d9e5338b835856fe3c5e45555c1a6bfbb6b7f412a83bbfaa0841813eeeeeb1 On load, index.js unconditionally requires./compat.js, which selects a platform-specific binary URL from string-split-obfuscated Cloudflare Workers...

Malicious code in devplatform-s3-resources (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85d9e5338b835856fe3c5e45555c1a6bfbb6b7f412a83bbfaa0841813eeeeeb1 On load, index.js unconditionally requires./compat.js, which selects a platform-specific binary URL from string-split-obfuscated Cloudflare Workers...

Malicious code in devplatform-spa-plugin-thermostat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe54d9f541a205ad779acf3da6216c85ec0e20b6a502aaff03dc88b7cf2d85c7 On require, index.js loads compat.js which selects a per-platform payload path, downloads a binary over HTTPS from rotating Cloudflare Workers...