MAL-2026-12588 Malicious code in checkout-promocode-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1d75e7966f60937203bdc9f6ee1a90e58fbf046f76ec5aa0b4d68018fce4f87 On require, index.js loads ext.js which selects a per-OS payload path, fetches an executable over HTTPS from string-concatenation-obfuscated hosts...

Malicious code in devplatform-spa-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50ddc07faa8afae95b4e759f77938829d91d2b548d2606c325555b0900fe61f1 On require of the package, index.js loads bridge.js, which selects a per-OS payload path, fetches an executable from a list of Cloudflare Workers hos...

Malicious code in devplatform-rest-resources-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51db57b10cf3d072768e05a81ef61a8b1fffef1437ab1455ca04d1227d845316 On require of devplatform-rest-resources-v2, index.js loads adapter.js which selects a per-OS payload path, fetches an opaque binary over HTTPS from...

MAL-2026-4378 Malicious code in @databus-service-ui/scroll-up-content (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02414b019347c91f59a506d88dffc19306c7c287936df0d42327ad6b32eb0bf2 scripts/postinstall.js performs two independent attacker-benefit actions when npm install runs. First, it scrapes installer-side secrets — environmen...

MAL-2026-4420 Malicious code in @polka-ui/loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f93cf8dde7e6a1252424fc82f38e8502a37d9e427d92d412fd8944c91b8ee5a4 On npm install, scripts/postinstall.js downloads a per-OS payload from https://oob.moika.tech/payload/linux|mac|win, writes it to /tmp/.polka-uiinit....