MAL-2026-13209 Malicious code in @guangnao/claude-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9276dba65fd393d94c5beb06122b1297994c96bda03d940f34fcc59016e4c5b The bundled CLI at bin/claude-cli.js hardcodes a hub endpoint https://hub.client-llm.com that is concealed behind a bespoke base64+XOR decoder functi...

Malicious code in dolyame-boxy-atom-bnpl-info-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfa5d8518650ddd83b31e9587264a2ed049a47db5c8452af6d62eb50e9fa336 On load, index.js requires./loader.js which reconstructs anonymous host names via array-join obfuscation...

MAL-2026-13324 Malicious code in dolyame-boxy-independent-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation...

Malicious code in dolyame-boxy-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce523b3385816616192d462b5ac251d22886682d021200c4bd76bd22b95003c On require of this package, index.js loads setup.js which downloads a platform-specific native binary from author-controlled Cloudflare Workers hosts...

Malicious code in dolyame-boxy-mobile-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 180d09900ce4462a9d4c9b47dcc26491bfb50aacd5a226a3571211007edb3ad2 index.js unconditionally requires./setup on module load. setup.js branches on process.platform linux/darwin/win32, fetches an opaque binary from...

Malicious code in dolyame-ui-confirmation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dba60f94522cc371a13cce00e6a8e51678812f3f50f3e577fd5e9275295a72e0 [email protected] ships a shim.js that is required from index.js at module load. On import, shim.js detects the host OS/architecture,...

MAL-2026-13186 Malicious code in dolyame-ui-storybook-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0df8669e15c61895263cb0fc334c38027fe01b749646c3d3f74baee35684cb1 The package's main entry index.js unconditionally requires ext.js, which on module load selects a platform-specific asset, fetches an opaque binary...

MAL-2026-12851 Malicious code in bigops-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f281ddf755708d180e0d2817df0e23c640fb1ab2d17441c7f35309bb37086bc1 index.js unconditionally requires./vendor at module load. vendor.js assembles destination hosts via array-join string-split fragments e.g...

Malicious code in bnpl-blocks-atom-bnpl-carousel-line (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f49d0a2f45c6a825ed105c2859c618bedcc4643650bf6719c35c47e462c553c8 On require of the package's main entry, index.js loads./shim.js, which assembles attacker-controlled hostnames from string-split arrays e.g...

MAL-2026-12903 Malicious code in bnpl-blocks-atom-desktop-bnpl-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 007bafa1def88d10e8f2c247e0ab1d0872d2a4f33f4bb134fe46877f75aa9eca On require, index.js unconditionally loads polyfill.js, which selects a platform-specific asset path and fetches an opaque binary from one of three...

Malicious code in bnpl-blocks-atom-bnpl-skeleton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2e88e9faf590414055ba1b7b48bdaa51df5e33735b9dd526e5d8d0650eceae7 On require of the package's main entry, init.js fetches a platform-specific binary from obfuscated Cloudflare Workers hostnames assembled by joining...

MAL-2026-12938 Malicious code in bnpl-blocks-desktop-bnpl-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaa5e2ca983c49eefb3d32e333435a236f63c2d896ac41aed7b56114c477964c On require, index.js loads init.js which reconstructs a set of hostnames from split-string fragments e.g...

MAL-2026-12960 Malicious code in bnpl-blocks-independent-bnpl-main-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85d01515b559e3e623341b5838615add9439fc1d3942948acb3ca2aee86e9579 On require of the package, index.js loads bridge.js whose top-level run downloads a platform-specific binary from author-controlled Cloudflare Worker...

MAL-2026-12968 Malicious code in bnpl-blocks-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 386248e103371d4e302c8325a3d1b76c4269256b1c374c95f539104230f60149 The package ships a loader loader.js that assembles remote hostnames at runtime from string-split arrays reconstructing subdomains of wel1.ru and a...

Malicious code in bnpl-blocks-mobile-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c54195f215860087ea60839eed874351de1bf279c7a80d12c128214d3602b26 On require of the package, index.js loads./vendor.js, which assembles Cloudflare Workers hostnames from split string fragments...

MAL-2026-13002 Malicious code in bnpl-blocks-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a02f6576518bfc325248a8787aff66ebad12acc3e63b05fd7b35f96ffd1a62d6 The package's index.js requires runtime.js on load, which fetches a platform-specific native binary from one of three Cloudflare Workers hosts...

MAL-2026-13016 Malicious code in bnpl-blocks-seo-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fafe459f610c3c0c55f043148b4900bc1c70b4f02adfc7a440afbe115ca3b36a [email protected] declares itself an SEO tool but on module load index.js requires./support.js fetches a platform-specific native binary...

MAL-2026-13013 Malicious code in bnpl-blocks-post-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd5d8d3c9328912323fee5066e4c32c14904ec3e8b1800f66da0d1749babda0c On require, polyfill.js reconstructs attacker-controlled hostnames from string-split fragments oob-worker.cf103-070.workers.dev, with a DNS-TXT...

MAL-2026-12520 Malicious code in caen-caen-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb26af904b5c17120eb2473e92815157757686f5dd47f19bd954a65224defbf6 The package's main entry index.js loads ext.js on require. ext.js downloads an OS-specific native binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12614 Malicious code in claims-enums (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e On require'claims-enums', index.js loads polyfill.js which selects a platform-specific asset path and fetches an opaque binary over HTTPS from...