Malicious code in devplatform-zod-wip-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2629721fa3107222cef1f1669d474e7b3b45346ed87a455a168c1d199d9c6492 [email protected] is a typosquat/lookalike of the zod ecosystem that acts as an import-time dropper. index.js unconditionally...

MAL-2026-13278 Malicious code in dlp-dlp-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a7f83a18ee0f4d41331997bd85740febbb8d8e581fa9026b83112e55d2b8320 On require'dlp-dlp-core', index.js loads setup.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac,...

Malicious code in dolyame-boxy-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7992916c62a9926f06f313367b6b684674413ecac4fe8cf1e0130165ae651fc7 On require of the package, index.js loads adapter.js, which downloads a platform-specific native binary from hardcoded destinations assembled via...

MAL-2026-13290 Malicious code in dolyame-boxy-atom-bnpl-store-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdce627f475557b2376352c5dbc9cc8970949fdccef36073a4665c01fe4af92f On require, index.js loads platform.js which reconstructs download hostnames from split-and-joined array literals e.g. oob-worker.cf99-9b3.workers.de...

MAL-2026-13288 Malicious code in dolyame-boxy-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfa5d8518650ddd83b31e9587264a2ed049a47db5c8452af6d62eb50e9fa336 On load, index.js requires./loader.js which reconstructs anonymous host names via array-join obfuscation...

Malicious code in dolyame-boxy-component-story-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c0c190f59af98fd97bf6638398afd2a774dc07593d1d954b85fd150d7ce0c32 On require of this package, support.js reconstructs Cloudflare Workers hostnames from split string fragments e.g...

MAL-2026-13300 Malicious code in dolyame-boxy-desktop-bnpl-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f786ddb8f05c51044f41661db16ceb96657060ba36d0ead043d430cf4e30a11 Requiring the package loads vendor.js, which reconstructs remote hosts from array-join fragments resolving to Cloudflare Workers hosts such as...

MAL-2026-13307 Malicious code in dolyame-boxy-desktop-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ac9b6ff477d28984f8498e58ccc09c6addc4ecce2816fd46f25e5b4cfca49dc On require of this package, index.js loads bridge.js which auto-executes an init routine that fetches a platform-specific binary from runtime-assembl...

Malicious code in dolyame-boxy-independent-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3d08e3dbef59d66846b1b2ef0080f02c8f2c3597eb4725db3c6f62c8fcb231 index.js unconditionally requires./loader on load. loader.js selects a platform-specific payload path linuxx64, linuxarm64, darwin, win32 and downloa...

Malicious code in dolyame-boxy-independent-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 955003be540a21f5e2fd1a7a5a5586276a5cc7f733c09d1f5412250fe0035f1b On require of the package, index.js loads setup.js, which selects a platform-specific path, fetches an opaque binary from a rotating pool of Cloudfla...

MAL-2026-13330 Malicious code in dolyame-boxy-independent-bnpl-swagger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c9922ed471321378d155bfabb5d15f3efe59f8524e30face28e25dadd3305b3 dolyame-boxy-independent-bnpl-swagger ships an index.js that unconditionally requires setup.js on load. setup.js reconstructs remote hostnames from...

Malicious code in ded-aa-common-ded-aa-common-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30a80297ae44091b682bf8fa68610f345348813d94b2c84e7f82a3183b938a94 On require of the package, index.js loads ext.js which fetches an opaque platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-13146 Malicious code in dolyame-ui-codemods (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa4592f76ef0995b4e3c8b0cc15c00862cf594cbaebbfcd2bf25d2640bbf6012 On require'dolyame-ui-codemods', index.js loads polyfill.js, which reconstructs remote hostnames from split string-fragment arrays joined at runtime...

Malicious code in dolyame-ui-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ebf602f046406a056b2d9d36768cf4592ae2f8a02375b0fdb5212c3cc1e80ca On require of dolyame-ui-footer, index.js loads./runtime.js which selects a per-OS payload path, fetches a binary via HTTPS from one of three hardcod...

MAL-2026-13157 Malicious code in dolyame-ui-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f21d1f60c7f97ffdc8e698c9804d9d9116f286be7a026a9c90f6e4a1858dea18 On require'dolyame-ui-grid', index.js loads polyfill.js which selects a platform-specific asset, downloads a binary from one of four hardcoded...

MAL-2026-13159 Malicious code in dolyame-ui-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15f91ac3c4278628875a5c009c515bcdb5fbc8b885eb32dff56e4367c5babf66 On require, index.js loads bootstrap.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints hostnames assembled at...

MAL-2026-13175 Malicious code in dolyame-ui-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b05e7a5637334bae528a1971c767adea5eba27b6c1386f778f6a5f54ea5ff18 On require'dolyame-ui-popup', index.js loads helpers.js which immediately fetches a platform-specific binary from string-split Cloudflare Workers...

Malicious code in dolyame-ui-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a91813719fa2a9e32f75eb75dfa1774f222790b2134366fb99fb27114ab4b247 On require of the package main, init.js selects a platform-specific asset and downloads an opaque binary over HTTPS from a rotating set of...

MAL-2026-13172 Malicious code in dolyame-ui-pagination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7acc8dae4428c1b1cbf6ba1dc8199cdd4b07bf06aceca87a603fd34fd18834f7 On require of the package, index.js loads./polyfill.js, which immediately executes a dropper routine. The dropper assembles destination hostnames at...

MAL-2026-13187 Malicious code in dolyame-ui-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c154e71b3fe4bf6957b180aa41ecdc789c11ea90928aab8c66c52a90c6428051 On require of the package's main entry, index.js loads platform.js which assembles obfuscated hostnames via array.join"" to reach...