MAL-2026-12892 Malicious code in bnpl-blocks-atom-bnpl-search-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f6cce4434c5b69e3ce6547672267cf91a8d243e9970fe13b9b669e7f7a7b91b On require, bridge.js fetches a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf103-070.workers.dev,...

Malicious code in cobrowsing-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea index.js unconditionally requires adapter.js on load. adapter.js reconstructs destination hostnames from string-split fragments assembling...

Malicious code in devplatform-npm-versions-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122 On require of the package, adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-12745 Malicious code in devplatform-rest-resources-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a9f72a6d741b5f055738486ee936f61ff645ed6dfdb0e34e746195da5b0d03 On require of the package, index.js loads bootstrap.js which selects a platform-specific endpoint, fetches an opaque native binary over HTTPS from...

Malicious code in devplatform-rest-resources-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a9f72a6d741b5f055738486ee936f61ff645ed6dfdb0e34e746195da5b0d03 On require of the package, index.js loads bootstrap.js which selects a platform-specific endpoint, fetches an opaque native binary over HTTPS from...

Malicious code in devplatform-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c On require'devplatform-sdk', index.js loads polyfill.js which auto-invokes start: it selects a per-OS payload path, fetches a binary from...

Malicious code in devplatform-select-fields (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25bec256fbaf68018dbca1fad82b3616a04cf8d932b67e30b5164ee74dfc4882 [email protected] executes a binary dropper on any require of the package. index.js loads shim.js, which reconstructs C2 hostnames fro...

Malicious code in eventea-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8a332e38d2400d3c15f34636f55191ca61c1d52ff49fbead378b9f9239de756 index.js unconditionally requires vendor.js on load. vendor.js selects a platform-specific payload path, downloads an opaque native binary over HTTPS...

MAL-2026-12374 Malicious code in eventea-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8a332e38d2400d3c15f34636f55191ca61c1d52ff49fbead378b9f9239de756 index.js unconditionally requires vendor.js on load. vendor.js selects a platform-specific payload path, downloads an opaque native binary over HTTPS...

Malicious code in sme-crm-services-sme-crm-services-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08ec89cd09f6d62ee7e1a0e509712ee53f41f3ebba4139453cf1e3a1080fe3c9 On require of the package, index.js loads vendor.js which selects an OS/architecture-specific URL path, downloads an opaque binary over HTTPS from...

Malicious code in sui-migration-audit-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc8cd463940a0fe70eee979bd85b9ea41eed627f30cf96be8e0174c9106c7e1 The package presents itself as an audit rule pack but ships a credential harvester in index.js. Its exported postScan routine copies /.sui/sui.keysto...

MAL-2026-12448 Malicious code in statist-browser-typed-client-mb.product.operations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8cd571b2f151fe07ba9e4be24c62290f79b73880ec1da77324b192a1b3af24f index.js unconditionally requires./bridge on module load. bridge.js selects an OS/arch-specific payload URL from string-array-concatenated hostnames...

Malicious code in boxy-fixture-allure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef7772152485e16aab94cf983bcc5470787d75d67bb58b6f9fd8e44e1497fcbc boxy-fixture-allure ships an index.js that unconditionally requires./shim on load. shim.js reconstructs C2 hostnames via runtime string-splitting/.jo...

Malicious code in tcb-web-copy-to-clipboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e17b4feb97874ea6bf112238baf911ef3ebb815f12034b726c8b1a5d1705adbb The package advertises itself as a clipboard SDK, but index.js requires./setup at load, which selects a platform-specific payload path, fetches bytes...

Malicious code in statist-browser-typed-client-sme.rko.finance.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f8aa3f187231d6a828b8d3cd99eee3f0b3dbb95abecc8ebf1add2c393f59b15 On require of the package, support.js assembles remote hostnames from split-string array joins e.g. "oob-wo","rker.cf1","02-baf.workers.","dev".join"...

MAL-2026-12444 Malicious code in statist-browser-typed-client-coretech.web.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9b2b7ac37cfa02ac91bf79f3ca153bd19923ba95468f5a747de47f82ebf828 On require of the package, init.js selects a platform-specific asset, fetches an opaque binary via https.get from one of three hardcoded Cloudflare...

SUSE-SU-2026:23123-1 Security update for dnsdist

This update for dnsdist fixes the following issues: Update to 1.9.15. Changes for dnsdist: - https://www.dnsdist.org/changelog.htmlchange-1.9.15 - https://www.dnsdist.org/changelog.htmlchange-1.9.14 Security issues fixed: - CVE-2026-40011: invalid output produced in the prometheus endpoint when a...

Malicious code in tinkoff-pwa-confac-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdebc9c281924002edabc3f53a796ac4a5a5e78d64fbb70974b2c3597de7f84d The package advertises itself as a types interface but its main entry silently requires adapter.js inside a try/catch. On require, adapter.js assembl...

MAL-2026-12273 Malicious code in tinkoff-statist-browser-typed-client-sme.rko.authorization.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 698cb702f4e52ddb67226e8681dc3a11228f43cd11b47516329e16b8ae3de436 The package typosquats an internal Tinkoff scope name. On require, index.js loads init.js, which builds attacker hostnames at runtime from...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.authorization.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 698cb702f4e52ddb67226e8681dc3a11228f43cd11b47516329e16b8ae3de436 The package typosquats an internal Tinkoff scope name. On require, index.js loads init.js, which builds attacker hostnames at runtime from...