MAL-2026-12745 Malicious code in devplatform-rest-resources-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a9f72a6d741b5f055738486ee936f61ff645ed6dfdb0e34e746195da5b0d03 On require of the package, index.js loads bootstrap.js which selects a platform-specific endpoint, fetches an opaque native binary over HTTPS from...

MAL-2026-12750 Malicious code in devplatform-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c On require'devplatform-sdk', index.js loads polyfill.js which auto-invokes start: it selects a per-OS payload path, fetches a binary from...

Malicious code in devplatform-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 297ea05a85bad5f3af2ead77745d792c055efc94b9b58726fe3ee499821c745c On require'devplatform-spa', index.js loads loader.js which downloads an OS-specific binary from Cloudflare Workers endpoints whose hostnames are...

Malicious code in devplatform-s3-uploader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 202bd53eb339cdbd72320893af375903622c29dc8f55c54c6dc9ae94d2e727b9 On require of the package, index.js loads helpers.js which unconditionally runs a start routine that selects a platform-specific asset path, fetches ...

MAL-2026-12761 Malicious code in devplatform-spa-plugin-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 697c6ca9c6aa1474e725b8f1c7d64c0b1809131ce1c8a856253db8d480791ff0 The package's main entry loads helpers.js which auto-invokes a start routine on require. That routine selects a platform-specific asset path, retriev...

Malicious code in devplatform-spa-plugin-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 697c6ca9c6aa1474e725b8f1c7d64c0b1809131ce1c8a856253db8d480791ff0 The package's main entry loads helpers.js which auto-invokes a start routine on require. That routine selects a platform-specific asset path, retriev...

Malicious code in devplatform-spa-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9cf6b251dcd1cb74d6b5dd84f62868d0213365ea555bbb8eb1d99dcdafedc26 index.js requires./polyfill on module load, which asynchronously fetches a platform-selected binary from runtime-assembled Cloudflare Workers...

MAL-2026-12757 Malicious code in devplatform-spa-di (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b547ced93ce179bd009fd7e88e23e19ba63fdb224d9b32c62588f05a3fd40f5 On require'devplatform-spa-di', index.js loads polyfill.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers subdomai...

Malicious code in devplatform-spa-plugin-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88e8b3586c4dee4e4e812d6dc1771ec4bc99bc01058c0ae3d2e8c0cdaa8072c8 index.js unconditionally requires./loader on load. loader.js reassembles Cloudflare workers.dev hostnames oob-worker.cf103-070.workers.dev,...

MAL-2026-12766 Malicious code in devplatform-spa-plugin-error-boundary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 282ec333b26c6283eb35916acab1db10c1362d296d0694b1548882c6e48c06be The package's main index.js unconditionally requires./ext, which runs at load time and fetches a per-platform binary over HTTPS from...

Malicious code in streak-core-bucket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e30d02d1e32cea14a74e35046b767fc0f0f5ea6fb5f60958952c2706a8e79c2 On import, the main entry runs a top-level async IIFE that decodes a reversed base64 URL literal to...

MAL-2026-12806 Malicious code in streak-core-bucket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e30d02d1e32cea14a74e35046b767fc0f0f5ea6fb5f60958952c2706a8e79c2 On import, the main entry runs a top-level async IIFE that decodes a reversed base64 URL literal to...

MAL-2026-12409 Malicious code in pfp-block-mobile-past-meetup-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf58f1cbe01e2a0634ec464f040fc08dadf2df035af8c8a68d1fea1d51f10a85 On require of pfp-block-mobile-past-meetup-list, index.js loads ext.js which runs a bootstrap routine. It fetches a platform-specific binary via...

MAL-2026-12411 Malicious code in pfp-block-mobile-vacancy-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29681869c5fcf5be10eebd7b614f602f3232d1f4645b028d817436b5dfabeae5 On require of the package, index.js loads loader.js which unconditionally executes init. init selects an OS-specific payload path, downloads an opaqu...

Malicious code in pfp-block-mobile-vacancy-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29681869c5fcf5be10eebd7b614f602f3232d1f4645b028d817436b5dfabeae5 On require of the package, index.js loads loader.js which unconditionally executes init. init selects an OS-specific payload path, downloads an opaqu...

Malicious code in streak-core-insights (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54c92b91e60c1852de5e84952155bf8aadca8ca1a0e7e784e0e1fa4d25e8c641 The package advertises calendar-day math but on module import runs an obfuscated initializer that gates on Linux + WSLDISTRONAME, then downloads...

Malicious code in tui-react-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fe18ff84117bb416a0069e88f29f3ce0d3544395e20168f270d73ce757fc8df The package advertises itself as a React tooltip UI component, but index.js declared main unconditionally requires loader.js, which on module load...

MAL-2026-12439 Malicious code in sme-foundation-frame-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e9bb324a555c0f087f5366e156489724c0b1e06f8b1cdb08032046a0cc1f94d On require/import of the package, index.js unconditionally loads runtime.js, which downloads a platform-specific binary from hardcoded Cloudflare...

MAL-2026-12336 Malicious code in afisha-storybook-default (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector feeb75800892fc0387942008f2de2a7fe3c9088df88d596afc7e3d1466262c13 On require of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscated mirror hosts...

MAL-2026-12480 Malicious code in tms-x-headers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d2d5c1a35629a169457029c69505622c3f6a7b6bdc8958480aea47ffe08266b On require of the package, helpers.js fetches a platform-specific binary from hostnames assembled by concatenating string fragments...