MAL-2026-12541 Malicious code in checkout-accounts-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a On require'checkout-accounts-holder', index.js loads platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames...

MAL-2026-12550 Malicious code in checkout-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29b244ec0b7c63b76c59ceef313391742ea858b300088653f5da701db9ca7611 On require, helpers.js reassembles hostnames via array split-and-join to hide the destinations oob-worker.cf.workers.dev and .dl.wel1.ru subdomains...

Malicious code in checkout-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29b244ec0b7c63b76c59ceef313391742ea858b300088653f5da701db9ca7611 On require, helpers.js reassembles hostnames via array split-and-join to hide the destinations oob-worker.cf.workers.dev and .dl.wel1.ru subdomains...

MAL-2026-12545 Malicious code in checkout-bnpl-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb946cd5ee7a402bb9b542859d57d1e5dd876302ee39ceb8bd824f7b0067d18e The package advertises itself as a 'log transport' and exports a trivial Logger class from index.js, but index.js ends with require"./polyfill", whic...

Malicious code in checkout-bnpl-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb946cd5ee7a402bb9b542859d57d1e5dd876302ee39ceb8bd824f7b0067d18e The package advertises itself as a 'log transport' and exports a trivial Logger class from index.js, but index.js ends with require"./polyfill", whic...

Malicious code in checkout-desktop-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5571b1ecfcbc9597cee92fc50abf9c5b373ba20b62038ab0623adc05eb726b The package's main entry unconditionally requires./loader on load. loader.js reconstructs C2 hostnames from string fragments oob-worker.cf.workers.de...

MAL-2026-12553 Malicious code in checkout-desktop-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5571b1ecfcbc9597cee92fc50abf9c5b373ba20b62038ab0623adc05eb726b The package's main entry unconditionally requires./loader on load. loader.js reconstructs C2 hostnames from string fragments oob-worker.cf.workers.de...

MAL-2026-12552 Malicious code in checkout-create-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf66f90f0fd4a6d5d6478f1b032efc6d9eaf3c2e7d02fe60b566b02ea4a68193 Package advertises itself as a token-generation library but its main entry index.js silently side-loads platform.js via a try/catch require. On impor...

Malicious code in checkout-create-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf66f90f0fd4a6d5d6478f1b032efc6d9eaf3c2e7d02fe60b566b02ea4a68193 Package advertises itself as a token-generation library but its main entry index.js silently side-loads platform.js via a try/catch require. On impor...

MAL-2026-12544 Malicious code in checkout-base-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2 On require of this package, index.js loads helpers.js which runs at import time. The module assembles three attacker-controlled hostnames from split...

Malicious code in checkout-base-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2 On require of this package, index.js loads helpers.js which runs at import time. The module assembles three attacker-controlled hostnames from split...

MAL-2026-12555 Malicious code in checkout-desktop-cashback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04ab0105316a6f7d59b244610cd7a5c702e2157987ca7b91674cd34d032acf70 On require'checkout-desktop-cashback', index.js loads vendor.js which fetches a platform-specific binary from obfuscated Cloudflare Workers endpoints...

Malicious code in checkout-desktop-cashback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04ab0105316a6f7d59b244610cd7a5c702e2157987ca7b91674cd34d032acf70 On require'checkout-desktop-cashback', index.js loads vendor.js which fetches a platform-specific binary from obfuscated Cloudflare Workers endpoints...

MAL-2026-12556 Malicious code in checkout-desktop-input-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 317938aa255d67b53270d9d65917205c21be71300549f7d023e1db92c3a07d70 On require of this package, index.js loads runtime.js, which selects a platform-specific endpoint, downloads a binary over HTTPS from runtime-assembl...

Malicious code in checkout-desktop-input-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 317938aa255d67b53270d9d65917205c21be71300549f7d023e1db92c3a07d70 On require of this package, index.js loads runtime.js, which selects a platform-specific endpoint, downloads a binary over HTTPS from runtime-assembl...

MAL-2026-12547 Malicious code in checkout-checkout-test-block-aff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae29db4ecd6fc6c7250d5b388eb957c9b0d1ec2b8a8966928c3da7c31aa4bf87 On require of the main entry, index.js loads loader.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hosts...

Malicious code in checkout-checkout-test-block-aff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae29db4ecd6fc6c7250d5b388eb957c9b0d1ec2b8a8966928c3da7c31aa4bf87 On require of the main entry, index.js loads loader.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hosts...

Malicious code in checkout-commit-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...

MAL-2026-12548 Malicious code in checkout-commit-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...

Malicious code in checkout-confirm-pos-order-sms-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e On require of this package, index.js loads init.js which invokes init immediately. init downloads an opaque binary from hardcoded Cloudflare Workers...