MAL-2026-13506 Malicious code in dolyame-ui-inputbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c05d783314187af31df2f0152cc2809660ec45808c3e5f38071e8bfe7ac08dd6 On require of the package, index.js loads loader.js and lib/telemetry.js, both of which act as remote-binary droppers. Hostnames and dangerous API...

MAL-2026-13125 Malicious code in dolyame-boxy-mobile-bnpl-image-plus-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 653c411e19cc545e0b3189f5bc2cc24b583b574fe661c27eeedae4f5f3372ecb The package's main entry index.js unconditionally requires vendor.js, which on load runs an async routine that selects a platform-specific payload UR...

MAL-2026-12948 Malicious code in bnpl-blocks-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5181e44b181b008c8345153784c66020faa73f1f591fc070a1f20f105ba8f2c6 The package presents itself as a fonts helper but its index.js unconditionally requires./ext, which on module load fetches a platform-specific binary...

Malicious code in boxy-cook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 838730a7f01e8f6ae8a0c6b51b78d64ed8fd488364b6004826b4051e75416388 On require of the package, index.js loads polyfill.js which fetches a platform-specific native binary and executes it. Destination hostnames are...