Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d957fec8c08e1dcadbcd6e4b6933a1c1482356e79adbfe1f6ceb6d64a68855f On require of the package, bootstrap.js selects a platform-specific path from a hardcoded map, downloads an opaque binary from one of three Cloudflar...

MAL-2026-13654 Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d957fec8c08e1dcadbcd6e4b6933a1c1482356e79adbfe1f6ceb6d64a68855f On require of the package, bootstrap.js selects a platform-specific path from a hardcoded map, downloads an opaque binary from one of three Cloudflar...

MAL-2026-13647 Malicious code in sme-rko-finance-front-operations-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26817ccf57c03ae447f3181ec0a18c3cf5a2bcd09da40cd8aaa3fa56446ab21 On require/import, index.js loads./bootstrap and re-exports./lib/telemetry, both of which execute a download-and-execute dropper. bootstrap.js...

MAL-2026-13596 Malicious code in dolyame-ui-progressline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e109a79a8ebbb2a7d21a37668b162bc92a5602ad24e7db6b6ce711f5cee152f6 On require, index.js loads shim.js which fetches a platform-specific binary from hardcoded Cloudflare Workers endpoints...

Malicious code in dolyame-ui-inputcount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7a3d0d930d73916ee9555c5a2c1ca8596f25a4336041d881f268504ad8fab06 On require of the package, helpers.js runs a setup routine that detects host OS/architecture, downloads a platform-specific binary from one of four...

Malicious code in bigops-shared-product-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8f6d857df9a0aa674b5354167a3eb1c28634b9e61a9436f19a9ffcb8a8b734 [email protected] ships adapter.js, which is unconditionally loaded via index.js on require. On load it fetches a platform-specific...

Malicious code in dolyame-ui-overridestyles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d2bc1cbc6567633387613915ff6d5637770cfa636a8d0ec14c99ef91b73a72 On require of the package, compat.js invokes a setup routine that downloads a platform-specific binary from Cloudflare Workers hosts assembled by...

Malicious code in dolyame-ui-inputbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c05d783314187af31df2f0152cc2809660ec45808c3e5f38071e8bfe7ac08dd6 On require of the package, index.js loads loader.js and lib/telemetry.js, both of which act as remote-binary droppers. Hostnames and dangerous API...

MAL-2026-13514 Malicious code in eacq-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b500358c69db5b11d186a6656bd7e20b6ae98cf8f8b437af7b320d511f870761 On require of eacq-core, both helpers.js and lib/telemetry.js download a platform-specific binary from Cloudflare Workers hosts assembled at runtime...

MAL-2026-13304 Malicious code in dolyame-boxy-desktop-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626b386d1f127bc0ed973dbac051023f0f021b0be476d1cd8678802ef98c5d42 On require of the package, index.js unconditionally loads bootstrap.js, which downloads a platform-specific binary from hostnames assembled via...

Malicious code in dolyame-ui-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 714598919807b4143a734772e690ff94aa986fb6cf61bd99026e7f7bc93f4cf2 On require of the package's main entry, loader.js runs a platform-detecting downloader that fetches an executable from obfuscated hostnames...

Malicious code in beaver-ui-search-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 117b4f6c7e9e402d92085e427c4b40874e9b6838e16c15562408a0bda241f9ae The package presents itself as a UI dropdown library but on require executes init.js, which selects a platform-specific asset linux/darwin/win32,...

Malicious code in bigops-stylelint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d8d967bce96a9d30c6af4599e7658d63327067655539f14f2bfd1cd8a663350 The package advertises itself as a stylelint 'quality gate' but on require its main entry loads bootstrap.js, which downloads a platform-specific...

MAL-2026-12846 Malicious code in bigops-timers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3857e871cb391df75568052701aae6a172eedcee963519c5e6ac9feeff9cbb On require of bigops-timers, index.js loads compat.js which downloads a platform-specific binary from Cloudflare Workers hosts...

MAL-2026-12888 Malicious code in bnpl-blocks-atom-bnpl-radio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73e47adf2b698665ad917ed4a512279a35c56dc9683950843d18f207d91767e2 Requiring this package loads polyfill.js, whose top-level initialization downloads a platform-specific binary from runtime-reassembled hosts...

MAL-2026-12892 Malicious code in bnpl-blocks-atom-bnpl-search-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f6cce4434c5b69e3ce6547672267cf91a8d243e9970fe13b9b669e7f7a7b91b On require, bridge.js fetches a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf103-070.workers.dev,...

Malicious code in bnpl-blocks-desktop-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0028d1bea265a3e3fdcbbe1d43188f3aef4b4c332a995352c19ac5a090c42ac On require of the package, index.js loads support.js which reconstructs remote hostnames from string-array fragments joined with.join'' to defeat...

MAL-2026-12920 Malicious code in bnpl-blocks-desktop-bnpl-faq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0028d1bea265a3e3fdcbbe1d43188f3aef4b4c332a995352c19ac5a090c42ac On require of the package, index.js loads support.js which reconstructs remote hostnames from string-array fragments joined with.join'' to defeat...

Malicious code in bnpl-blocks-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5181e44b181b008c8345153784c66020faa73f1f591fc070a1f20f105ba8f2c6 The package presents itself as a fonts helper but its index.js unconditionally requires./ext, which on module load fetches a platform-specific binary...

Malicious code in bnpl-blocks-independent-bnpl-origination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7441b8e4b9daaaa54b9963006ffa7868dc6f2d7ffaa65b4c11a029c43240dde1 On require of the package's main entry, runtime.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at...