Malicious code in sme-rko-finance-front-operations-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd5c58bd9b678ac91c87dbb7f9a1d2318c67cd3754d643550c7674c903186de On require, this package loads ext.js and lib/telemetry.js which fetch a platform-specific opaque binary from a rotating list of attacker-controlled...

Malicious code in dolyame-ui-contextmenu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc9417de8f321490efb9f6d13312f2e45513235b71198bcf9901f76cdd587438 On require of the package, polyfill.js downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains...

MAL-2026-13561 Malicious code in dolyame-ui-contextmenu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc9417de8f321490efb9f6d13312f2e45513235b71198bcf9901f76cdd587438 On require of the package, polyfill.js downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains...

MAL-2026-13225 Malicious code in bigops-nitro-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfbd116994566a3e99f61697a738787d8089c2c99dbc9d5c55f9f3902a6b8cff On require, index.js loads vendor.js which downloads a platform-specific native binary from rotating Cloudflare Workers endpoints...

MAL-2026-13283 Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from...

Malicious code in dolyame-boxy-desktop-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee The package main index.js requires ./init on load. init.js assembles hostnames via string-split .join'' obfuscation to produce a rotating list of...

MAL-2026-13322 Malicious code in dolyame-boxy-independent-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3d08e3dbef59d66846b1b2ef0080f02c8f2c3597eb4725db3c6f62c8fcb231 index.js unconditionally requires./loader on load. loader.js selects a platform-specific payload path linuxx64, linuxarm64, darwin, win32 and downloa...

Malicious code in dolyame-boxy-independent-bnpl-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f29e1e3b6b3a01a935dbcd19077e516c17d31c3674078ecfe2cd112b0137437 On require, index.js loads init.js which reconstructs hostnames from split-string arrays e.g. 'oob-worker.cf102','-baf.workers.','dev'.join'' and...

MAL-2026-13331 Malicious code in dolyame-boxy-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd3ad7593e26ae49876e0310a51ac122ddcb6878eefddc74a5828cce061d200b On require of the package, index.js loads init.js which assembles obfuscated Cloudflare Workers hostnames oob-worker.cf.workers.dev from string-split...

Malicious code in dolyame-boxy-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd3ad7593e26ae49876e0310a51ac122ddcb6878eefddc74a5828cce061d200b On require of the package, index.js loads init.js which assembles obfuscated Cloudflare Workers hostnames oob-worker.cf.workers.dev from string-split...

Malicious code in dolyame-ui-flag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be48c86f2b67912c3cfa1849431e5eb3d45510c55bb1fa98ab304dc36d25097b On require of the package, index.js loads vendor.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev hosts...

Malicious code in dolyame-ui-radio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49a775fc526a9d050f679466553ee679e1c85046f8122fd93c07efe0af0a28cd [email protected] is a dropper disguised as a UI/telemetry package. index.js unconditionally requires./adapter.js, which on module load downloa...

Malicious code in dolyame-ui-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9a2d0e912bed4c7005a9945215406319204611c186b19d77065d1a5216e5fb1 Requiring the package loads ext.js, which downloads a platform-specific binary from obfuscated .workers.dev endpoints with a DNS-TXT base64 fallback...

Malicious code in bigops-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49069c4e461f88725c6657a31565110fba41d9fa5525d9683d071614ceb6f7f6 On require'bigops-api', index.js loads compat.js which detects OS/arch, downloads a platform-specific binary from runtime-assembled hostnames fragmen...

MAL-2026-12832 Malicious code in bigops-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49069c4e461f88725c6657a31565110fba41d9fa5525d9683d071614ceb6f7f6 On require'bigops-api', index.js loads compat.js which detects OS/arch, downloads a platform-specific binary from runtime-assembled hostnames fragmen...

Malicious code in bigops-telephony-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93b10fc5eff860f82de5bc03b910dbe2b96b06d54c22741cbb593b007dd9ee38 On require of the package, shim.js downloads a platform-specific executable over HTTPS from string-concatenated hostnames...

Malicious code in bigops-watchdog-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65df39f269239434211427140c77c096d41d8de8800667ef39a27bf89572c67 On require of bigops-watchdog-worker, index.js loads runtime.js which reconstructs remote hostnames from split-string fragments e.g. joining...

Malicious code in bnpl-blocks-atom-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d0716eec6e29280316b67f3e9a98954f501dc73a692d36b68d8106b39bd60fb On require of this package, index.js loads shim.js which assembles obfuscated non-publisher URLs by joining split string fragments resolving to a...

MAL-2026-12910 Malicious code in bnpl-blocks-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a50b0415c63c49a45364f4a287439682ce2b0d2b95a6fa250e8c01feff20c91f On require, support.js fetches a platform-specific binary from obfuscated hosts assembled by array-join fragments oob-worker.cf99-9b3.workers.dev...