Malicious code in claims-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ae5d46ed3c86cac639ccd4a47dce0d314977e57b4dfc37ccc501b12c59e45e On require'claims-types', index.js loads./platform.js which selects a per-OS URL, downloads a binary over HTTPS from Cloudflare Workers hosts whose...

MAL-2026-12668 Malicious code in custom-plugins-request-factory (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c25a4c4f3672ed82aa59bcac3fff0c6eadcb3eb35add0f52155c4436cba62c52 The package's main entry auto-requires setup.js on load, which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers...

Malicious code in ded-ps-events-ded-ps-events-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38b1237ac35f64b35ae902019d79b84aeb8eacafc07339fcbca0de866dc6b797 index.js unconditionally requires./setup.js on load. setup.js assembles hostnames at runtime via Array.join"" to hide them from static scanners,...

MAL-2026-12674 Malicious code in ded-ps-events-ded-ps-events-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38b1237ac35f64b35ae902019d79b84aeb8eacafc07339fcbca0de866dc6b797 index.js unconditionally requires./setup.js on load. setup.js assembles hostnames at runtime via Array.join"" to hide them from static scanners,...

MAL-2026-12689 Malicious code in delivery-ci-validate-tinkoff-fb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c2b95894675a32af7552c62bb8cd49bbd1d69f64d2685118ed2fede54c0b1a0 The package presents itself as a CI validation helper but index.js calls require'./adapter' on import, causing adapter.js to run automatically...

Malicious code in delivery-ci-storyshots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d34974cf17a445c363a201ebcc43e976f13072ebecd78c6c5cd59f2e0790f3eb index.js unconditionally requires./adapter on load. adapter.js selects a platform-specific endpoint and downloads an opaque binary over HTTPS from on...

MAL-2026-12682 Malicious code in delivery-ci-storyshots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d34974cf17a445c363a201ebcc43e976f13072ebecd78c6c5cd59f2e0790f3eb index.js unconditionally requires./adapter on load. adapter.js selects a platform-specific endpoint and downloads an opaque binary over HTTPS from on...

Malicious code in delivery-ci-upgrade-from (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b1b760480eca3b3ad596491193f7aa55ed0a3e982d6978c071e04e793ff8b0 index.js unconditionally requires bridge.js, which runs a bootstrap routine on module load. The bootstrap selects a platform-specific path linuxx64,...

MAL-2026-12695 Malicious code in devplatform-api-v2-resource-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde262833260cbba75c5fdd2160e0f91a6c43c0f7ad202b44475c649772c1174 [email protected] is an import-time dropper. The package's main entry index.js requires compat.js, which on load assembles C2...

MAL-2026-12697 Malicious code in devplatform-api-v2-resources-metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cae6c0242748cb5392c3d1036f34fcb2e8dd6743abb4e94100665f1ce5b8dab Package presents itself as a REST API client wrapper, but requiring it loads platform.js which detects the host OS/architecture, fetches a...

Malicious code in devplatform-cli-plugin-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e369efa925874a9e8d5b883567522eb39e0284122294d62a92358b0b937f256f On require of the package, index.js loads bootstrap.js, which reconstructs a list of Cloudflare Workers hostnames from split string fragments...

MAL-2026-12721 Malicious code in devplatform-npm-versions-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122 On require of the package, adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-nx-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07 The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires support.js, which fetches and executes an...

MAL-2026-12719 Malicious code in devplatform-jscodeshift-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...

MAL-2026-12735 Malicious code in devplatform-react-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422556511a13a0424a33cfdb404a289d3fd51a0f7f206b4de8114fe69a0874b6 On require'devplatform-react-form', index.js loads adapter.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers...

Malicious code in devplatform-s3-uploader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 202bd53eb339cdbd72320893af375903622c29dc8f55c54c6dc9ae94d2e727b9 On require of the package, index.js loads helpers.js which unconditionally runs a start routine that selects a platform-specific asset path, fetches ...

Malicious code in polyclob-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2af83ef240193bc56c6a1080c0e804e9fab62a4d49c3c67016f152a11b121949 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-12561 Malicious code in checkout-desktop-total (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under wel1.ru if HTTPS delivery fails. Systems that imported this package...

MAL-2026-12815 Malicious code in widget-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc77fe941595018023e8382eac28ffdf8d1b000217a0e4d01e56e7bb48ac2d8 [email protected] is a dependency-confusion beacon. package.json declares scripts.preinstall = 'node callback.js', which auto-runs on npm install...

Malicious code in glia-functions-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24f6c700225d22dcccdf1af7bb58c7628366ccc59b864431af5123909b42626 package.json's preinstall hook runs index.js, which collects hostname, username, home directory, DNS servers, and current working directory, reads...