MAL-2026-13046 Malicious code in boxy-fixture-pendel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbad559799410017202aafce879de36d171f9480e4cd995e4e5fe5cb3bddb830 On require'boxy-fixture-pendel', index.js loads support.js which asynchronously downloads a platform-specific binary from obfuscated destinations...

MAL-2026-12382 Malicious code in finance-business-company-id-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d324092012d8b7c4dda17720255575963c9e35fcd86e254541cdf7abb5edffcf On require of this package, index.js loads compat.js which reconstructs destination hostnames from string-split arrays e.g...

MAL-2026-12226 Malicious code in time-webkit-tag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4da59763ac0349051b13656079486ab8c8c08971ff18c5efa84fbf8f5ce022a0 On require of the package, index.js loads init.js which unconditionally invokes start. start selects a platform-specific asset path, assembles CDN...