MAL-2026-12874 Malicious code in bnpl-blocks-atom-bnpl-fade-overflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f78c9360e199f852a5b395b6549e12b6334ec3dce096462a4404a3a0e809f545 On require of this package, index.js loads runtime.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

Malicious code in bnpl-blocks-atom-bnpl-integrations-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2708bb1921034553386778769eccfeb8858cc65d8890b438cb7dc07bfb1eb60 On require, the package's main entry loads ext.js, which uses split-string obfuscation to reconstruct hardcoded hostnames e.g...

MAL-2026-12687 Malicious code in delivery-ci-upgrade-from (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b1b760480eca3b3ad596491193f7aa55ed0a3e982d6978c071e04e793ff8b0 index.js unconditionally requires bridge.js, which runs a bootstrap routine on module load. The bootstrap selects a platform-specific path linuxx64,...

Malicious code in devplatform-cli-plugin-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8460a9cc2fce88e69d25156ea88612a5a67ffba26709ce88900d573e2f4b3ea On require of the package, index.js loads bootstrap.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads an...

MAL-2026-12714 Malicious code in devplatform-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b21acc89730541bc58390e2694a9e5410417e5232bb4f4d47c0c27b035e2f4 Package is published as an i18n library but its main entry index.js requires./setup on load. setup.js selects a per-platform payload path, fetches...

MAL-2026-12452 Malicious code in statist-browser-typed-client-sme.platform.mobile.voip.common.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb43194ddda04c3dffa5cb6bea02c8bc6edba8623acf172c5da744b2488e13b0 On require, compat.js selects a platform-specific payload path and downloads an opaque binary from one of four Cloudflare Workers hosts...

MAL-2026-12346 Malicious code in cardsmobile-collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 103c6f5e66de4d466d79c8a4247f46670fad0de2601a93f37fa6280c5491cc41 On require of the package,./runtime.js runs a top-level setup that downloads a platform-specific binary from string-concatenated hostnames...

Malicious code in travel-core-typings-reducers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f8a32e0a10123bde764e059abea762d4b0574d57d35e6bd3e92e4d96cdeb245 On require of the package, index.js loads ext.js which downloads a platform-specific binary from runtime-assembled Cloudflare workers.dev hostnames...

Malicious code in time-linters-webapp-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b89eb401bae118699fcd79b686c0d6ace5e579df1ea42a87d6ad18de405614c The package's top-level index.js unconditionally requires./runtime on load. runtime.js assembles a rotating list of Cloudflare Workers hostnames...

Malicious code in pvm-autodoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f92e3ecba043a713f37e35f3162b1454e17991b2860c0923a6aa8fced87c6d On require'pvm-autodoc', index.js loads bridge.js which downloads a platform-specific native binary from one of four hardcoded Cloudflare Workers...

Malicious code in statist-browser-typed-client-eventea.projects.pfpacquiring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac6e075f28ea6c98d015ce67f6a884c19aaeb522edab1098f3010d91aae92a59 index.js unconditionally requires bridge.js, which on load detects OS and architecture, assembles destination hostnames via array-join string...

MAL-2026-12445 Malicious code in statist-browser-typed-client-eventea.projects.pfpacquiring (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac6e075f28ea6c98d015ce67f6a884c19aaeb522edab1098f3010d91aae92a59 index.js unconditionally requires bridge.js, which on load detects OS and architecture, assembles destination hostnames via array-join string...

Malicious code in saas-f-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b4a492a289f0cc0ec0f924149b0cd29521c60747d6fe700d84d03ddddcd8a65 On require, index.js loads setup.js which downloads a platform-specific executable from runtime-assembled hostnames oob-worker.cf103-07.0.workers.dev...

Malicious code in travel-core-utils-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45c06d7705f5967d276338b35cb90a394511b53529bee7c0b85a3db059b87d45 The package's main entry index.js has a side-effect require of bridge.js, which on load selects a platform-specific asset, fetches an opaque binary...

MAL-2026-12264 Malicious code in tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba0f8f5362c28a3be51253f23b5bd737f0232d9563d1adcbfb3c891f8ed56dd0 Package main entry require's./adapter on load, which reconstructs Cloudflare workers.dev hostnames and a well1.site fallback domain via split-string...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1202cc47d9e9135b8b86db17305d80e50b516ef5e77ebd1771a1c5184b6cb8 The package's index.js unconditionally requires./loader, which on load fetches a platform-specific executable from Cloudflare Workers endpoints...

Malicious code in twork-products-taiga2-products-investment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64ab6e4ef4d1c4dafd75af4c52d747069dd76fa1ba8d958f2c82ba7fba2e8a0 On require of the package, init.js unconditionally loaded from index.js fetches a platform-specific executable from one of three obfuscated Cloudflar...

MAL-2026-12305 Malicious code in twork-products-taiga2-products-investment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64ab6e4ef4d1c4dafd75af4c52d747069dd76fa1ba8d958f2c82ba7fba2e8a0 On require of the package, init.js unconditionally loaded from index.js fetches a platform-specific executable from one of three obfuscated Cloudflar...

PT-2026-66471

The SSH service on BSH ELP Electronic Platform modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorized keys file for the root user. An attacker in possession of the...

Malicious code in parallely (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a862cdceb2998828aba8de0d4a672b86a2c22dff073356e5acd89e894aced56 The npm package name parallely typosquats concurrently: package.json advertises the concurrently repository, author, and funding while shipping...