MAL-2026-12832 Malicious code in bigops-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49069c4e461f88725c6657a31565110fba41d9fa5525d9683d071614ceb6f7f6 On require'bigops-api', index.js loads compat.js which detects OS/arch, downloads a platform-specific binary from runtime-assembled hostnames fragmen...

MAL-2026-12840 Malicious code in bigops-telephony (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da1b7311c033191d85d0d19c679ac9d453f7517897b57618d0d8977d654daf94 On require'bigops-telephony', index.js loads adapter.js which selects a platform-specific asset path, fetches an opaque binary from one of three...

Malicious code in bigops-tcrm-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f4cc9ef61d16a5c70a1adc9c2ab3acb9e51d650967f02621410285d99efd4a1 The package's main index.js requires./setup on load. setup.js selects a platform-specific payload path, downloads a native binary over HTTPS from...

Malicious code in bigops-timers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3857e871cb391df75568052701aae6a172eedcee963519c5e6ac9feeff9cbb On require of bigops-timers, index.js loads compat.js which downloads a platform-specific binary from Cloudflare Workers hosts...

Malicious code in beaver-ui-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f257786868c5d56c3f9f79e674980d07bfad3a42194819837623614554abb77 On require'beaver-ui-list', index.js loads ext.js, which selects a payload path based on OS and architecture, downloads a native binary from hardcode...

MAL-2026-12873 Malicious code in bnpl-blocks-atom-bnpl-email-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4990414fbbea6c3a7c19539ac76eeee019ae4657756545743b4b54bdece4a135 Requiring the package's main entry transitively loads init.js, which selects an OS/architecture-specific endpoint and downloads a binary from one of...

Malicious code in bnpl-blocks-atom-bnpl-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f37374f9e046ed30b7430e942c4e4f23ddc6ef55e76a3a00b2f40506c0f2bb9 On require of bnpl-blocks-atom-bnpl-text, index.js loads polyfill.js, which selects an OS-specific asset and fetches a binary over HTTPS from...

MAL-2026-12898 Malicious code in bnpl-blocks-atom-bnpl-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f37374f9e046ed30b7430e942c4e4f23ddc6ef55e76a3a00b2f40506c0f2bb9 On require of bnpl-blocks-atom-bnpl-text, index.js loads polyfill.js, which selects an OS-specific asset and fetches a binary over HTTPS from...

Malicious code in bnpl-blocks-desktop-bnpl-floating-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 475a5832e13fe3f55a82c47aace786100dd62ae9c5c5d31e7408ac59930cc917 On require of the package, index.js loads helpers.js which downloads a platform-specific binary from Cloudflare Workers hosts whose domain strings ar...

MAL-2026-12931 Malicious code in bnpl-blocks-desktop-bnpl-link-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3419412ce27e6f0442a6e828cf62c4f8851be28a969e977a799559e038c75ea7 On require of the package's main entry, index.js loads./vendor, which reconstructs Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

Malware in tramvai-tinkoff-module-legacy-popup

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in bnpl-blocks-desktop-bnpl-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaa5e2ca983c49eefb3d32e333435a236f63c2d896ac41aed7b56114c477964c On require, index.js loads init.js which reconstructs a set of hostnames from split-string fragments e.g...

MAL-2026-12948 Malicious code in bnpl-blocks-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5181e44b181b008c8345153784c66020faa73f1f591fc070a1f20f105ba8f2c6 The package presents itself as a fonts helper but its index.js unconditionally requires./ext, which on module load fetches a platform-specific binary...

Malicious code in bnpl-blocks-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 386248e103371d4e302c8325a3d1b76c4269256b1c374c95f539104230f60149 The package ships a loader loader.js that assembles remote hostnames at runtime from string-split arrays reconstructing subdomains of wel1.ru and a...

Malicious code in bnpl-blocks-mobile-bnpl-image-plus-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fe5dcff2d2c8210499718411ebd66f6810c42a8439728a3919636548598b494 On require of the package, compat.js assembles remote endpoint hostnames from split string arrays e.g. oob-worker.cf10x-.workers.dev and includes a D...

Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d On require of index.js, support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-13019 Malicious code in bnpl-blocks-stories-of-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2d298c1c7467e50e22e0822fb5a348773e76a2b06ab9028997578c3f1c86121 On require of this package, index.js loads bootstrap.js which downloads a platform-specific executable over HTTPS from a rotating list of...

Malicious code in bnpl-blocks-mobile-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6a276d26c910b007ca066878179b48828a21822a3d4fb4a711604700a537f9 On require of this package, main resolves to runtime.js, which assembles Cloudflare Workers hostnames by string-splitting...

MAL-2026-13008 Malicious code in bnpl-blocks-mobile-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6a276d26c910b007ca066878179b48828a21822a3d4fb4a711604700a537f9 On require of this package, main resolves to runtime.js, which assembles Cloudflare Workers hostnames by string-splitting...

Malicious code in boxy-bus-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6494a00553cc1e8c7e5ffdd957d31a21a33ab34a252979d7d6d551239fc0f79 On require of the package, index.js loads compat.js which downloads a platform-specific executable from attacker-controlled Cloudflare Workers hosts...