Malicious code in devplatform-npm-versions-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122 On require of the package, adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b21acc89730541bc58390e2694a9e5410417e5232bb4f4d47c0c27b035e2f4 Package is published as an i18n library but its main entry index.js requires./setup on load. setup.js selects a per-platform payload path, fetches...

MAL-2026-12714 Malicious code in devplatform-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b21acc89730541bc58390e2694a9e5410417e5232bb4f4d47c0c27b035e2f4 Package is published as an i18n library but its main entry index.js requires./setup on load. setup.js selects a per-platform payload path, fetches...

Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

MAL-2026-12742 Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

MAL-2026-12737 Malicious code in devplatform-react-micro-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38577b4e463996b1df19599f016c8ad16ebb36d8650effd666c93d844364c475 [email protected] is a lure package whose main entry auto-loads adapter.js on require. adapter.js selects a platform-specific...

Malicious code in devplatform-react-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422556511a13a0424a33cfdb404a289d3fd51a0f7f206b4de8114fe69a0874b6 On require'devplatform-react-form', index.js loads adapter.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers...

MAL-2026-12763 Malicious code in devplatform-spa-plugin-cobrowsing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96860be3701b6237d300a1c6e6bc23ff724f14557543451e221b255aff08a29e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

Malicious code in devplatform-spa-plugin-cobrowsing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96860be3701b6237d300a1c6e6bc23ff724f14557543451e221b255aff08a29e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

MAL-2026-12767 Malicious code in devplatform-spa-plugin-history (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 809274addc0525244480b108485ad3dbdba1a92b65025c1c48d549dd03c45f0b On require of the package, index.js loads bridge.js, which assembles platform-specific destination hostnames via string-split/array.join obfuscation...

Malicious code in devplatform-spa-plugin-s3-module-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1a4f4ab19296a9ece2741e6f813780cbdc84d5f7fe188024ad2deb51aa97b5a On require of the package's main entry, index.js loads adapter.js, which selects a platform-specific payload URL, fetches opaque bytes from one of...

MAL-2026-12779 Malicious code in devplatform-spa-plugin-s3-module-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1a4f4ab19296a9ece2741e6f813780cbdc84d5f7fe188024ad2deb51aa97b5a On require of the package's main entry, index.js loads adapter.js, which selects a platform-specific payload URL, fetches opaque bytes from one of...

MAL-2026-12781 Malicious code in devplatform-spa-plugin-suspense (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cbc392b622da2cfe503443ce6a7ee67083df8a9f6e371f13e1a7625f3379bd7 index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudflare Workers hosts...

MAL-2026-12784 Malicious code in devplatform-spa-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d43b8f8982db0f563db0d728dbc9ecdd9907e29dd45f2d9bf42e0c8416fc80fa On require'devplatform-spa-testing', index.js loads platform.js which selects a platform-specific endpoint, retrieves a payload over HTTPS from...

Malicious code in devplatform-spa-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d43b8f8982db0f563db0d728dbc9ecdd9907e29dd45f2d9bf42e0c8416fc80fa On require'devplatform-spa-testing', index.js loads platform.js which selects a platform-specific endpoint, retrieves a payload over HTTPS from...

Malicious code in checkout-desktop-total (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under wel1.ru if HTTPS delivery fails. Systems that imported this package...

MAL-2026-12797 Malicious code in multi-reqs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38937963f906d0bf3b4dac24a1a45f574aeb53cd2f268ffb9730d88bedf50bce The package's default export accepts token, password arguments and POSTs them, formatted as a Discord embed titled 'Yeni Hesap Bilgisi' with fields '...

Malicious code in multi-reqs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38937963f906d0bf3b4dac24a1a45f574aeb53cd2f268ffb9730d88bedf50bce The package's default export accepts token, password arguments and POSTs them, formatted as a Discord embed titled 'Yeni Hesap Bilgisi' with fields '...

Malicious code in node-cache-multithread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09be7b43b4fe5e0c786fb116e4a99518c46825e2b18b5e65eca88c51470b07a0 index.js, the package's declared main entry, is a 23KB obfuscator.io RC4/base64 string-array bundle whose top-level IIFE runs on require. It requires...

Malicious code in luluking2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 495a71c4dcddec545026181c7faeef59cf4c79b4816a148fb88c59c5465e8c97 On npm install, the package's postinstall hook runs index.js, which reconstructs a URL from a char-code array String.fromCharCode.apply on a numeric...