Malicious code in dolyame-ui-loader (npm)

Source: amazon-inspector 38e3316d577d11997d6d21e26dc346cf8f3cdb986d4e61d7ac95dac0c3eda7ba On require'dolyame-ui-loader', index.js triggers shim.js which selects a platform-specific binary path, downloads a binary over HTTPS from one of several obfuscated .workers.dev hosts reassembled at runtime...

Malicious code in devplatform-s3-uploader (npm)

Source: amazon-inspector 202bd53eb339cdbd72320893af375903622c29dc8f55c54c6dc9ae94d2e727b9 On require of the package, index.js loads helpers.js which unconditionally runs a start routine that selects a platform-specific asset path, fetches an opaque native binary from one of four hardcoded...

Malicious code in devplatform-spa-di (npm)

Source: amazon-inspector 0b547ced93ce179bd009fd7e88e23e19ba63fdb224d9b32c62588f05a3fd40f5 On require'devplatform-spa-di', index.js loads polyfill.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers subdomains oob-worker.cf100-416.workers.dev, cf99-9b3.workers.dev,...

Malicious code in devplatform-snarkdown (npm)

Source: amazon-inspector 050140bdd00f1d32d6a6142067c28c92fe95ff1be979f4272c8966ba58c78b92 On require of the package, shim.js selects a platform-specific URL, downloads a binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev, oob-worker.cf103-070.workers.dev,...

Malicious code in devplatform-api-v2-resources-metadata (npm)

Source: amazon-inspector 8cae6c0242748cb5392c3d1036f34fcb2e8dd6743abb4e94100665f1ce5b8dab Package presents itself as a REST API client wrapper, but requiring it loads platform.js which detects the host OS/architecture, fetches a platform-matched native binary from three...

Malicious code in claims-format-masked-phone-number (npm)

Source: amazon-inspector fa7c82af39243a3c62938129f431e38e106ddc3209511d8d8389995bc36590a6 The package advertises phone-number masking but on every require loads polyfill.js, which selects an OS/arch-specific asset and fetches an opaque native binary from one of four hardcoded Cloudflare Workers...

MAL-2026-14275 Malicious code in minequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54dfa76784b35d5d63fa89a85c071e83d21e55291871b40627c36015291f24a1 package.json declares a postinstall hook running scripts/init.js, which chmod 0755's assets/thanks-amd64.elf and execFileSync's it on Linux x64 durin...

Malicious code in dolyame-ui-generateid (npm)

Source: amazon-inspector 1db498e928fa247c2f3efbee2eaea516e60b450483e29d3537bac04061cbffdf On require of the package, index.js loads shim.js which selects a platform-specific payload URL by concatenating string fragments to reconstruct hostnames oob-worker.cf103-070.workers.dev,...

Malicious code in devplatform-eslint-config (npm)

Source: amazon-inspector de0fcdb30a4308ee477f432e1bcc665e8ee45f3dd36dd02f22089a4b9e2a69f9 [email protected] ships no ESLint configuration despite its name and description. Requiring the package loads compat.js, which on import selects a payload path based on OS/architecture linuxx6...

Malicious code in dolyame-boxy-independent-bnpl-main-banner (npm)

Source: amazon-inspector e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698 index.js unconditionally requires./bridge on load. bridge.js selects a per-platform payload linux x64/arm64, darwin, win32, fetches a native binary over HTTPS from a hardcoded list of Cloudflare .workers.dev...

Malicious code in dolyame-boxy-atom-bnpl-store-button-set (npm)

Source: amazon-inspector bdce627f475557b2376352c5dbc9cc8970949fdccef36073a4665c01fe4af92f On require, index.js loads platform.js which reconstructs download hostnames from split-and-joined array literals e.g. oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.dev,...

Malicious code in dolyame-boxy-atom-container (npm)

Source: amazon-inspector 8fb29bd9c1d233b882994262382b5f0b5b21cb2b868c139720d5ec9533ce9301 On require of the package, index.js loads helpers.js which invokes setup at module load. setup selects a platform-specific payload path linux/darwin/win32, rotates through obfuscated Cloudflare Workers...

Malicious code in devplatform-spa-plugin-s3-router (npm)

Source: amazon-inspector 8d2d2addbad66de5b68e55eb91db20968268ed1f7a951835a35aef1159e4af41 On require of devplatform-spa-plugin-s3-router, index.js loads helpers.js which runs a bootstrap routine at module load. The code assembles Cloudflare Workers hostnames oob-worker.cf10-0-416.workers.dev,...

Malicious code in bigops-nitro-events-table (npm)

Source: amazon-inspector 6d222994e1816e63b4047f5396bbfda8d6d2ccd6bbc840da4872aa026f879525 The package's index.js requires./shim on load. shim.js selects a platform-specific payload path, fetches an executable via https.get from one of three Cloudflare Workers hostnames reconstructed from...

Malicious code in devplatform-zod-wip-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2629721fa3107222cef1f1669d474e7b3b45346ed87a455a168c1d199d9c6492 [email protected] is a typosquat/lookalike of the zod ecosystem that acts as an import-time dropper. index.js unconditionally...

Malicious code in tinkoff-boxy-mobile-vivid-heading (npm)

Source: amazon-inspector 979353bc7d77343797621496972688b79dddd8688f1e1021b04a04c4d0572b31 On require of the package, runtime.js selects a platform-specific asset path and fetches an opaque binary over HTTPS from Cloudflare Workers hosts whose names are reconstructed at runtime via string-fragment...

Malicious code in tinkoff-ui-action (npm)

Source: amazon-inspector c00c178eed539f0535846617d7201e635f073f5f6477d7c9e2d1a6ce53f68d36 On require of the package's main entry, compat.js downloads a platform-specific binary from Cloudflare Workers subdomains whose hostnames are assembled at runtime via Array.join to evade static analysis e.g...

Malicious code in typography-stylecss (npm)

Source: amazon-inspector 4eeb50f69746fd21696baaa7d3534bbd22489edb037742ca591d49ca88981f70 The package impersonates the legitimate @tailwindcss/typography plugin: README, src/index.js, src/utils.js, and src/styles.js are copied verbatim from the Tailwind Labs plugin, and peerDependencies lists...

Malicious code in proto-bin (npm)

Source: amazon-inspector 1994859460fe293cad87eadf5c704e5c717c71deaaf54842f5e29fce765f99d5 Package is advertised as a prototype utilities library pack/unpack/checksum but its exported pack function calls an internal fetch that downloads a platform-specific binary from...

MAL-2026-4448 Malicious code in @tailwind-core/oxide-linux-x64-gnu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a107a0746f2f5159d661e4d332eac53f871b9d22f80caf5863bdd713e252ae00 The package name '@tailwind-core/oxide-linux-x64-gnu' impersonates the legitimate Tailwind CSS v4 oxide engine package...