Malicious code in bnpl-blocks-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a02f6576518bfc325248a8787aff66ebad12acc3e63b05fd7b35f96ffd1a62d6 The package's index.js requires runtime.js on load, which fetches a platform-specific native binary from one of three Cloudflare Workers hosts...

MAL-2026-13002 Malicious code in bnpl-blocks-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a02f6576518bfc325248a8787aff66ebad12acc3e63b05fd7b35f96ffd1a62d6 The package's index.js requires runtime.js on load, which fetches a platform-specific native binary from one of three Cloudflare Workers hosts...

Malicious code in bnpl-blocks-seo-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fafe459f610c3c0c55f043148b4900bc1c70b4f02adfc7a440afbe115ca3b36a [email protected] declares itself an SEO tool but on module load index.js requires./support.js fetches a platform-specific native binary...

MAL-2026-13016 Malicious code in bnpl-blocks-seo-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fafe459f610c3c0c55f043148b4900bc1c70b4f02adfc7a440afbe115ca3b36a [email protected] declares itself an SEO tool but on module load index.js requires./support.js fetches a platform-specific native binary...

MAL-2026-13013 Malicious code in bnpl-blocks-post-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd5d8d3c9328912323fee5066e4c32c14904ec3e8b1800f66da0d1749babda0c On require, polyfill.js reconstructs attacker-controlled hostnames from string-split fragments oob-worker.cf103-070.workers.dev, with a DNS-TXT...

MAL-2026-13035 Malicious code in boxy-cook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 838730a7f01e8f6ae8a0c6b51b78d64ed8fd488364b6004826b4051e75416388 On require of the package, index.js loads polyfill.js which fetches a platform-specific native binary and executes it. Destination hostnames are...

MAL-2026-13036 Malicious code in boxy-debugger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2 boxy-debugger 35.3.4 presents itself as a debugger library, but requiring the package triggers platform.js, which reconstructs attacker-controlled...

Malicious code in boxy-debugger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2 boxy-debugger 35.3.4 presents itself as a debugger library, but requiring the package triggers platform.js, which reconstructs attacker-controlled...

MAL-2026-13068 Malicious code in boxy-mif-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4e9fe90e4c6a7334c75fffb7bd07fdeb785a35b9fc2c1a9e5ce74265296d1c7 On require of this package, index.js loads bridge.js which downloads a platform-specific native executable from string-split obfuscated Cloudflare...

Malicious code in boxy-mif-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4e9fe90e4c6a7334c75fffb7bd07fdeb785a35b9fc2c1a9e5ce74265296d1c7 On require of this package, index.js loads bridge.js which downloads a platform-specific native executable from string-split obfuscated Cloudflare...

Malicious code in boxy-mmb-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f98f3a2dd8ca593bdd127f3fd631a10fe4a3c70f57890aa43e2da45b92d18d80 index.js unconditionally requires loader.js on module load. loader.js reconstructs hostnames by joining split string fragments evading static grep to...

Malicious code in boxy-test-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a5cc17bc186bfb165d7341ea7832b66bc93cafaa6f849ccc840660735c0cfa5 On require of the package, index.js loads ext.js which assembles C2 hostnames from split string fragments oob-worker.cf102-baf.workers.dev,...

Malicious code in bpm-foundation-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da9be4e91e8e8a5c0eea771a43103f8fde8202cd1a817fa7d511d8ab81788442 On require'bpm-foundation-auth', index.js loads adapter.js which selects a platform-specific asset and downloads an opaque native binary over HTTPS...

MAL-2026-13104 Malicious code in bpm-foundation-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da9be4e91e8e8a5c0eea771a43103f8fde8202cd1a817fa7d511d8ab81788442 On require'bpm-foundation-auth', index.js loads adapter.js which selects a platform-specific asset and downloads an opaque native binary over HTTPS...

MAL-2026-13103 Malicious code in bpm-foundation-app-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d87f6d54acae2240012663e4a9fa4dbd88b953dfe0669b1717887656f0554f7b index.js requires./setup on load. setup.js reassembles obfuscated hostnames via array-join Cloudflare Workers subdomains...

MAL-2026-13108 Malicious code in bpm-foundation-date-range (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fac5d5e2ebbf743977ac3ac1149da83ee41c1b7b98b10e97619e83fd3a18550c Requiring the package's main entry triggers polyfill.js, which selects a platform-specific endpoint and downloads a native binary over HTTPS from...

MAL-2026-12522 Malicious code in capacity-capacity-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6bca5365f5c34188532641c63143e3fd2306d2c7ffe64a78de98904c43d6b7c On require of the package's main entry, adapter.js downloads a platform-specific binary from one of three string-split-obfuscated Cloudflare Workers...

MAL-2026-12520 Malicious code in caen-caen-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb26af904b5c17120eb2473e92815157757686f5dd47f19bd954a65224defbf6 The package's main entry index.js loads ext.js on require. ext.js downloads an OS-specific native binary from hardcoded Cloudflare Workers hosts...

Malicious code in cbp-exchange-government-cbp-exchange-government-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e8845f778d906df5e69c06c91840deb7718a94ccacdd371c987b003f6d85bdb index.js unconditionally requires./loader on module load. loader.js assembles three Cloudflare Workers hostnames via split-array .join"" obfuscation...

MAL-2026-12551 Malicious code in checkout-create-draft-agreement-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d5b346e136a72594ca30d1e1d508bb152b82d20d8beb1d14bf126dd78b9977 On require of checkout-create-draft-agreement-am, index.js loads polyfill.js which downloads a platform-specific native binary from Cloudflare Worker...