MAL-2026-13037 Malicious code in boxy-demo-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4fef0cd8b9f91923e6bf6bf357c229e57bb3b108b48ddc3bc9f0faa8f16b8db On require, index.js loads bridge.js which fetches a platform-specific executable from Cloudflare Workers subdomains whose hostnames are reassembled...

Malicious code in boxy-wrapper-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50 The package's main entrypoint index.js unconditionally requires./compat.js, whose top-level main reconstructs obfuscated Cloudflare Workers hosts...