MAL-2026-13015 Malicious code in bnpl-blocks-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a0a2e3786f50dc07b4546de5ae22f3a65ad50e95897b8ca4d0fa6460b32d63 On require of bnpl-blocks-scroll, index.js loads helpers.js, which selects a platform-specific payload path and fetches an opaque native executable v...

MAL-2026-13006 Malicious code in bnpl-blocks-mobile-bnpl-shopping-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc4c244c6348b8ac4006067e983f7a3a58a7d00c5356d10d8d452c02823d1e1 On require of the package, index.js loads init.js which selects a platform-specific endpoint, downloads an opaque binary from rotating Cloudflare...

Malicious code in bnpl-blocks-mobile-bnpl-shopping-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc4c244c6348b8ac4006067e983f7a3a58a7d00c5356d10d8d452c02823d1e1 On require of the package, index.js loads init.js which selects a platform-specific endpoint, downloads an opaque binary from rotating Cloudflare...

Malicious code in bnpl-blocks-mobile-large-bnpl-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4fb3bbd6df612646af310ca9ec9e4d53cdeed9298b7e3e7c0460439b92d2955 On require of this package, loader.js selects a platform-specific asset path /pkg/package, /pkg/package-arm64, /pkg/loadermac, /pkg/package.exe,...

MAL-2026-13011 Malicious code in bnpl-blocks-mobile-large-bnpl-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4fb3bbd6df612646af310ca9ec9e4d53cdeed9298b7e3e7c0460439b92d2955 On require of this package, loader.js selects a platform-specific asset path /pkg/package, /pkg/package-arm64, /pkg/loadermac, /pkg/package.exe,...

Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d On require of index.js, support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-13009 Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d On require of index.js, support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-13017 Malicious code in bnpl-blocks-shops-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 209f1c0883ce38bd482d809b83edd85e8d3db75a379909e1b47ee24562c49526 index.js is the declared main entry and unconditionally requires./setup.js on load. setup.js reconstructs attacker-controlled endpoints via...

Malicious code in bnpl-blocks-shops-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 209f1c0883ce38bd482d809b83edd85e8d3db75a379909e1b47ee24562c49526 index.js is the declared main entry and unconditionally requires./setup.js on load. setup.js reconstructs attacker-controlled endpoints via...

Malicious code in bnpl-blocks-stories-of-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2d298c1c7467e50e22e0822fb5a348773e76a2b06ab9028997578c3f1c86121 On require of this package, index.js loads bootstrap.js which downloads a platform-specific executable over HTTPS from a rotating list of...

MAL-2026-13019 Malicious code in bnpl-blocks-stories-of-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2d298c1c7467e50e22e0822fb5a348773e76a2b06ab9028997578c3f1c86121 On require of this package, index.js loads bootstrap.js which downloads a platform-specific executable over HTTPS from a rotating list of...

MAL-2026-13018 Malicious code in bnpl-blocks-stories (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04845144f2e54662acd3413698e57b4efbbe44c47ddeb3c40c2fcc7383ae572c On require of the package, index.js loads./ext which reconstructs hardcoded hostnames via fragment-joined arrays e.g. oob-worker.cf99-9b3.workers.dev...

Malicious code in bnpl-blocks-stories (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04845144f2e54662acd3413698e57b4efbbe44c47ddeb3c40c2fcc7383ae572c On require of the package, index.js loads./ext which reconstructs hardcoded hostnames via fragment-joined arrays e.g. oob-worker.cf99-9b3.workers.dev...

Malicious code in bnpl-blocks-mobile-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6a276d26c910b007ca066878179b48828a21822a3d4fb4a711604700a537f9 On require of this package, main resolves to runtime.js, which assembles Cloudflare Workers hostnames by string-splitting...

MAL-2026-13008 Malicious code in bnpl-blocks-mobile-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6a276d26c910b007ca066878179b48828a21822a3d4fb4a711604700a537f9 On require of this package, main resolves to runtime.js, which assembles Cloudflare Workers hostnames by string-splitting...

MAL-2026-13025 Malicious code in bnpl-molecule-mobile-bnpl-onboarding (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23d110510740ced78dc5855c7f9c0c3dedff3669ad49cb52aeee3c5467f00d3b On require of the package, index.js loads runtime.js which selects a platform-keyed asset linux/darwin/win32, downloads an opaque binary from one of...

Malicious code in bnpl-molecule-mobile-bnpl-onboarding (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23d110510740ced78dc5855c7f9c0c3dedff3669ad49cb52aeee3c5467f00d3b On require of the package, index.js loads runtime.js which selects a platform-keyed asset linux/darwin/win32, downloads an opaque binary from one of...

Malicious code in boxy-add-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a91c45a1de3e17ac4c6595c6eac76736684ef353e3040a3e82b42e76911952 On require'boxy-add-script', index.js loads polyfill.js which reconstructs Cloudflare Worker hostnames from string-array fragments...

MAL-2026-13030 Malicious code in boxy-add-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a91c45a1de3e17ac4c6595c6eac76736684ef353e3040a3e82b42e76911952 On require'boxy-add-script', index.js loads polyfill.js which reconstructs Cloudflare Worker hostnames from string-array fragments...

Malicious code in boxy-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de3d566208b48f775ec51e3308934813973ad0a6fef6cb98fd438042056bb9b0 On require of the package, index.js loads shim.js which reconstructs attacker-controlled hostnames from split-string arrays Cloudflare Workers...