Malicious code in dolyame-ui-inputcolor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd621d8f38bf9cc61f7de47b10d8ef68fe086c42508366989552992e0bb8238 index.js unconditionally requires./loader on load. loader.js assembles attacker hostnames at runtime via array.join to hide them from static scanners...

Malicious code in eacq-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af2bcb4382f02a977f8448ea4f0172253035755b2d1dc363cce80f0389a1ee70 [email protected] contains a dropper reachable both from setup.js and from the main-exported lib/telemetry.js loaded on require'eacq-dialog'. The co...

MAL-2026-13229 Malicious code in bigops-opening-file-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39 On require of bigops-opening-file-handler, index.js loads support.js which selects a platform-specific asset linux/darwin/win32 and downloads an opaq...

MAL-2026-13271 Malicious code in devplatform-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0244bc7396ea5f52d909130a7d685fee98c0dda29cb18b82d17e8c9c90dff552 [email protected] ships an index.js whose main module requires bootstrap.js, which on load downloads a platform-specific binary payload from...

Malicious code in dolyame-boxy-atom-bnpl-store-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdce627f475557b2376352c5dbc9cc8970949fdccef36073a4665c01fe4af92f On require, index.js loads platform.js which reconstructs download hostnames from split-and-joined array literals e.g. oob-worker.cf99-9b3.workers.de...

Malicious code in dolyame-boxy-desktop-bnpl-image-plus-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4501ea4e0c044573a1d76bf04ee806de26c33bd1dc38f21a2d1f00988a96e656 On require of this package, index.js loads compat.js which selects platform-specific endpoints assembled from split string arrays e.g...

Malicious code in dolyame-boxy-independent-bnpl-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f29e1e3b6b3a01a935dbcd19077e516c17d31c3674078ecfe2cd112b0137437 On require, index.js loads init.js which reconstructs hostnames from split-string arrays e.g. 'oob-worker.cf102','-baf.workers.','dev'.join'' and...

Malicious code in dolyame-ui-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4dd05e52eb6422332d1d846b689062b7bc9c38ec3393eed9919e6bed3c56a2 The package advertises itself as a UI navigation toolkit, but its main entry index.js requires./compat.js, which on load fetches a platform-specific...

MAL-2026-13170 Malicious code in dolyame-ui-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4dd05e52eb6422332d1d846b689062b7bc9c38ec3393eed9919e6bed3c56a2 The package advertises itself as a UI navigation toolkit, but its main entry index.js requires./compat.js, which on load fetches a platform-specific...

MAL-2026-13173 Malicious code in dolyame-ui-pie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f473b4f8898130c8b57fd3a129bf81a38b449ea8970e58a6e4c486943eb5579 Requiring the package triggers async initialization in support.js that downloads a platform-specific binary linux x64/arm64, darwin, win32 from...

MAL-2026-12896 Malicious code in bnpl-blocks-atom-bnpl-store-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953b66d4203e461d482f00a2011c4d79b4fd30ab0749ca3e9946837d20e48504 The package's main index.js requires ./loader at module load, causing loader.js to download a platform-specific native executable from hardcoded...

MAL-2026-12947 Malicious code in bnpl-blocks-feature-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40f5d479d4fbf50975912fcbb27c8a3638cfeef78c8bd8a2e666162756abc788 index.js unconditionally require's./ext.js, which on load selects a platform-specific endpoint, fetches an opaque binary from Cloudflare Workers host...

Malicious code in bnpl-blocks-independent-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1d442b520a1779845bf9dc5d8a0cd822606ec46e0a01850143b93e14658cfe9 On require of the package, index.js unconditionally loads setup.js, which downloads an opaque binary from one of four hardcoded .workers.dev endpoint...

MAL-2026-12949 Malicious code in bnpl-blocks-independent-bnpl-anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79e1b9234ec9e2447ea3f3a53a8e4a16e4323d7f1138c2f0bedb4bc25fa43a1e On require'bnpl-blocks-independent-bnpl-anchor', index.js loads helpers.js which selects a per-platform payload, downloads an opaque binary from one ...

Malicious code in boxy-docusaurus-plugin-content-docs-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 282deb7b97e943caa32f55b14ac302a247a129edb04419d744f01b62666beaae [email protected] executes a dropper on require. index.js loads ext.js, which reconstructs destination hostnames at...

MAL-2026-13041 Malicious code in boxy-docusaurus-plugin-content-docs-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 282deb7b97e943caa32f55b14ac302a247a129edb04419d744f01b62666beaae [email protected] executes a dropper on require. index.js loads ext.js, which reconstructs destination hostnames at...

Malicious code in checkout-use-notifications (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a9b7cb00a4aac61795c81a085319cb8b0ac0aff1350a0dafddb4ef31d25a15f On require of the package, index.js unconditionally loads shim.js, which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12616 Malicious code in claims-format-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776846029f9cb0fea6a6afd33178425861ef02c062754874b2a49ff078095efd [email protected] auto-executes a binary dropper when the module is required. index.js requires./init on load; init.js downloads a...

MAL-2026-12289 Malicious code in twork-data-services-counterfree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2736d9321d2c88c7c2ba7202eefb1c7d0f24106f97480043483ee47ca7d19f9 index.js unconditionally requires./init on load. init.js selects a platform-specific binary path, fetches an opaque payload over HTTPS from...

MAL-2026-12299 Malicious code in twork-data-services-proxy-prime-api-v1-account-overdraft-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e5494883e9415a6efbc2775e753d413e111f02709b95688c94e09013dc8db8 On require of this package, index.js loads adapter.js which selects a platform-specific asset path /pkg/package, /pkg/package.exe, /pkg/loadermac,...