MAL-2026-12966 Malicious code in bnpl-blocks-independent-bnpl-preset-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc9c82b8cf411cb022edae70d6911b9b52637506ce2d1f9556275bbd251cb87a index.js unconditionally requires./support on module load. support.js selects a platform-specific asset path, fetches an opaque binary over HTTPS fro...

MAL-2026-12611 Malicious code in claims-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b517cc1646a1a45a32f432774adb0d4f7f82993b8b0c7c62b315fdf187b5877b The package's index.js unconditionally requires./helpers.js, whose top-level main executes on import. It downloads a platform-specific binary from...

Malicious code in devplatform-cra-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23e3df86e82704f0b114e616b4dc7f4acd0e5c377a336a61cb987625a31f3940 On require'devplatform-cra-template', index.js loads bootstrap.js, which selects a per-platform payload path and downloads bytes over HTTPS from one ...

Malicious code in @whalent/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13a01c1162adb93d3960d9e1b1b67095dcf0a1ea72aefa6d471d0abbbabb5d9a The package installs a whalent CLI daemon that opens a persistent WebSocket connection wss:// to a Whalent Memory gateway and, per its own README,...