MAL-2026-14217 Malicious code in ai-texts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f70364834c6aa09fed4520d6144867e921c75f416d315addf2ec3b28a92d2e4 The package advertises itself as text helpers for AI pipelines toText/normalizeText but src/index.js unconditionally invokes a dropper at module top...

Malicious code in ai-texts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f70364834c6aa09fed4520d6144867e921c75f416d315addf2ec3b28a92d2e4 The package advertises itself as text helpers for AI pipelines toText/normalizeText but src/index.js unconditionally invokes a dropper at module top...

Malicious code in sme-rko-finance-front-operations-fee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a2ef64871ebe6bf7dd675b3e686beec5a90dbaec72760b647e3c876674df9c5 The package's main entry ./lib/telemetry and its vendor.js module execute a binary dropper at require/import time. Hostnames and API identifiers are...

Malicious code in bigops-operator-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a On require of this package, index.js loads support.js which selects a platform-specific asset path linux/darwin/windows, fetches a binary payload fro...

MAL-2026-13129 Malicious code in dolyame-boxy-mobile-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 180d09900ce4462a9d4c9b47dcc26491bfb50aacd5a226a3571211007edb3ad2 index.js unconditionally requires./setup on module load. setup.js branches on process.platform linux/darwin/win32, fetches an opaque binary from...

MAL-2026-13194 Malicious code in dolyame-ui-textarea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24932ddb1e2cd6672b95aae062c330f9aec9d68ee293488d54d195fbbf0acc52 The package's main entry unconditionally requires./loader.js on load. loader.js assembles mirror hostnames from split string arrays to build a set of...

MAL-2026-12847 Malicious code in bigops-tinkoff-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29cb54c5f503b1cad2b4ae932f592d8870df743b1c1b6b029616343b65f6ae09 On require of the package, index.js loads runtime.js which fetches a platform-specific binary from Cloudflare Workers hosts...

Malicious code in bigops-tinkoff-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29cb54c5f503b1cad2b4ae932f592d8870df743b1c1b6b029616343b65f6ae09 On require of the package, index.js loads runtime.js which fetches a platform-specific binary from Cloudflare Workers hosts...

Malicious code in bnpl-blocks-atom-bnpl-navigation-arrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac730391d7dd3e3b320792e22983d3d225a08701364594a2db02d8c19f1bf868 Requiring this package executes platform.js, which detects the host OS/arch, fetches an opaque binary from one of four author-controlled Cloudflare...

MAL-2026-12969 Malicious code in bnpl-blocks-independent-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8e34f125883bf487e46fede3b2094978e853711c0688c8712cc5628e929f0ad Requiring this package triggers init.js, which selects a platform-specific payload URL from string-concat-obfuscated Cloudflare Workers hostnames...

Malicious code in bnpl-blocks-mobile-bnpl-category-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3b498a386a4aeab43aedc022880d8bf90e2d8feb2cc94bafe313fa73c09b4b1 On any require of this package, index.js loads loader.js, which reconstructs destination hostnames at runtime from array-join fragments...

MAL-2026-13002 Malicious code in bnpl-blocks-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a02f6576518bfc325248a8787aff66ebad12acc3e63b05fd7b35f96ffd1a62d6 The package's index.js requires runtime.js on load, which fetches a platform-specific native binary from one of three Cloudflare Workers hosts...

Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d On require of index.js, support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-13009 Malicious code in bnpl-blocks-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c1a4cb2ddfbe0f5126ad8072a17c51956f6b6ac4b77fb887c1ece69b9fb3d On require of index.js, support.js unconditionally executes a dropper routine: it HTTPS-fetches an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-13050 Malicious code in boxy-global-modules-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce609c23d8c990c21c16692270dbb62589c6f63e716994c31e5ed4f466dcad7 On require of the package's main entry, loader.js immediately fetches a platform-specific opaque binary over HTTPS from hardcoded Cloudflare Workers...

MAL-2026-13090 Malicious code in boxy-test-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b9bbda2467ea797cb846a04b6a8c3bb71b3cfed619f7688f533050fa2f51eb [email protected] executes a remote binary dropper on any require of the package. index.js unconditionally loads bootstrap.js, which downloads a...

Malicious code in cardsmobile-rs-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e561191e4649855e72a45b41f9fe45375ee5558a851e0c029dce070aa23d5608 On require'cardsmobile-rs-api', index.js loads support.js, which reconstructs remote hosts via string-array join oob-worker.cf103-070.workers.dev,...

MAL-2026-12624 Malicious code in claims-historical-claims-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7434149cb83ab4bb1378b89c5fd8165ce08bf714df3258c0a4b2ba67940c997 index.js unconditionally requires loader.js on module load. loader.js reconstructs remote hostnames from split string fragments e.g...

MAL-2026-12441 Malicious code in sme-scripts-shared-library-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a07df8d1831729273ad5bbc396191492c36cbf0f4d870af35c1101579ce0c9 [email protected] executes an install/import-time dropper. index.js requires./setup at module load, which selects a...

Malicious code in bigops-api-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acd531683a48496b0b96d04fb0264b4e49f46d43a099af7172bd259c20bf7bcc On require of the package, index.js loads runtime.js which selects a platform-specific endpoint from a list of Cloudflare Workers subdomains...