Malicious code in sme-rko-finance-front-payments-domain (npm)

Source: amazon-inspector d8fcad12c3078bf2134f5e3cafd7ffa0ecf9f2bfec919533881d5c65b738b9fa On require of the package, index.js loads./polyfill.js which assembles a set of C2 hostnames from split string fragments via.join'' — resolving to oob-worker.cf99-9b3.workers.dev,...

Malicious code in bigops-procedure-player (npm)

Source: amazon-inspector 4e28923577eff8eba09d7ebbd941220727c1851cf46ef25f4de8960070ad33bb On require, index.js loads loader.js, which reconstructs delivery hostnames at runtime via array.join"" e.g. oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf101-adf.workers.de...

MAL-2026-13281 Malicious code in docsmate-docsmate-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev and siblings cf100-416, cf101-adf,...

Malicious code in dolyame-boxy-independent-bnpl-items (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b31579fb9a360c4781524c5edd9d0e7b84440e7ccd073e09d54afc10678764cf On require of this package, index.js loads compat.js which unconditionally downloads an OS-specific binary from Cloudflare Workers hosts assembled at...

Malicious code in bnpl-blocks-atom-bnpl-no-index-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02bfd5111a000f3f369e2f973d3717b22e1718fb2edbc4b38a07b67aa395815b On require of the package, index.js loads bootstrap.js which detects OS and architecture, then fetches an OS-specific binary from...

MAL-2026-12883 Malicious code in bnpl-blocks-atom-bnpl-no-index-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02bfd5111a000f3f369e2f973d3717b22e1718fb2edbc4b38a07b67aa395815b On require of the package, index.js loads bootstrap.js which detects OS and architecture, then fetches an OS-specific binary from...

MAL-2026-12991 Malicious code in bnpl-blocks-mobile-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f511a9eac93e0ef06eeec5ab7ec22330cb092c4fda952ec540f4a9be3fc522f On require of the package, index.js loads bridge.js which fetches an OS-specific binary from hardcoded Cloudflare Workers hosts...