MAL-2026-12949 Malicious code in bnpl-blocks-independent-bnpl-anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79e1b9234ec9e2447ea3f3a53a8e4a16e4323d7f1138c2f0bedb4bc25fa43a1e On require'bnpl-blocks-independent-bnpl-anchor', index.js loads helpers.js which selects a per-platform payload, downloads an opaque binary from one ...

Malicious code in bnpl-blocks-independent-bnpl-mobile-application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 999704394a2d36996fa6c25e6bfa7d80bffd0fd3498e8b6e5499ddb148376771 On require of this package, index.js loads adapter.js which selects a per-platform payload linuxx64, linuxarm64, darwin, win32, downloads bytes from...

Malicious code in devplatform-spa-plugin-thermostat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe54d9f541a205ad779acf3da6216c85ec0e20b6a502aaff03dc88b7cf2d85c7 On require, index.js loads compat.js which selects a per-platform payload path, downloads a binary over HTTPS from rotating Cloudflare Workers...

MAL-2026-12782 Malicious code in devplatform-spa-plugin-thermostat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe54d9f541a205ad779acf3da6216c85ec0e20b6a502aaff03dc88b7cf2d85c7 On require, index.js loads compat.js which selects a per-platform payload path, downloads a binary over HTTPS from rotating Cloudflare Workers...

Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4 The package is presented as a trivial event emitter but its main entry index.js auto-loads bootstrap.js on require. bootstrap.js selects a per-platfo...

MAL-2026-12271 Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.employees.common.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48c11733eb4b38a76b46aec55e66c98300f8fa301d065f27c271b45e0157c6b4 The package is presented as a trivial event emitter but its main entry index.js auto-loads bootstrap.js on require. bootstrap.js selects a per-platfo...

MAL-2026-12046 Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f On require of the package's main entry, compat.js runs as a side effect: it selects a per-platform payload, fetches a native binary over HTTPS from o...