MAL-2026-13368 Malicious code in express-dever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31 [email protected] registers postinstall: node index.js in package.json, and index.js is heavily obfuscated obfuscator.io-style rotated string array...

Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

Malicious code in dlp-dlp-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a7f83a18ee0f4d41331997bd85740febbb8d8e581fa9026b83112e55d2b8320 On require'dlp-dlp-core', index.js loads setup.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac,...

Malicious code in dolyame-boxy-atom-desktop-bnpl-highlighted-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 539999c456d5c8a3f5e2028b9bd7a0f8ca3ab41af3c67044ef7735e0c9f76845 On require, polyfill.js selects a platform-specific payload, fetches an executable from one of three Cloudflare Workers hosts whose names are assembl...

MAL-2026-13326 Malicious code in dolyame-boxy-independent-bnpl-preset-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84696fc788619027dfd5efa2c8a27158b9afb95af39201163586f7fc5f27bd1a index.js requires platform.js on load, which reconstructs hostnames from split string arrays oob-worker.cf10-.workers.dev and sdk.dl.wel1.ru to hide...

Malicious code in dolyame-boxy-independent-bnpl-preset-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84696fc788619027dfd5efa2c8a27158b9afb95af39201163586f7fc5f27bd1a index.js requires platform.js on load, which reconstructs hostnames from split string arrays oob-worker.cf10-.workers.dev and sdk.dl.wel1.ru to hide...

MAL-2026-13323 Malicious code in dolyame-boxy-independent-bnpl-origination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0512db79eba207153d2427271566e3ecd016d3d817266e683a801d82183254e9 On require, index.js loads ext.js which detects platform, constructs C2 hostnames by joining split string fragments e.g. "oob-worker.cf99-9b3.worker"...

MAL-2026-13315 Malicious code in dolyame-boxy-independent-bnpl-code-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7222a6cf31e1412fd943bcf3b140b02f6c615b1650f9c39cabf813801557ae On require of the package, index.js loads ext.js which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers hosts...

MAL-2026-13330 Malicious code in dolyame-boxy-independent-bnpl-swagger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c9922ed471321378d155bfabb5d15f3efe59f8524e30face28e25dadd3305b3 dolyame-boxy-independent-bnpl-swagger ships an index.js that unconditionally requires setup.js on load. setup.js reconstructs remote hostnames from...

Malicious code in dolyame-boxy-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1830a31476314b9c1be462eba26a2314ed333d547a3f55bb62ff7ca44b5c9074 On require, index.js loads loader.js which selects a platform-specific payload path, fetches bytes over HTTPS from obfuscated hosts assembled via...

MAL-2026-13137 Malicious code in dolyame-ui-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d0fed433faae413825a41330dcf81ec06db856008fdf7ebb4cd3e385626b4ce On require of the package's main entry index.js, adapter.js unconditionally fetches an opaque binary payload from runtime-reconstructed Cloudflare...

Malicious code in dolyame-ui-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f8bf970c387898705de052ea5736f3f90877cfcdad204af1a772b5230c95c31 On every require of dolyame-ui-layout, index.js loads platform.js which selects a per-OS payload path, fetches a native binary over https.get from...

Malicious code in dolyame-ui-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4dd05e52eb6422332d1d846b689062b7bc9c38ec3393eed9919e6bed3c56a2 The package advertises itself as a UI navigation toolkit, but its main entry index.js requires./compat.js, which on load fetches a platform-specific...

Malicious code in dolyame-ui-react-version-switch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ee4e207fd01bae956d7fe084377ecea438f81774ea01ca6b02a50c1962c6cca Package advertises itself as a React UI helper but its index.js unconditionally requires./vendor at load time. vendor.js selects a platform-specific...

MAL-2026-13176 Malicious code in dolyame-ui-portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cf459576a54fb40358c8e22e4283559ce302a6d6e2c6cd545b48ae9be4d8ccf index.js unconditionally requires./bridge on load. bridge.js assembles Cloudflare Workers hostnames oob-worker.cf100-3-.workers.dev and a DNS-TXT...

Malicious code in dolyame-ui-portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cf459576a54fb40358c8e22e4283559ce302a6d6e2c6cd545b48ae9be4d8ccf index.js unconditionally requires./bridge on load. bridge.js assembles Cloudflare Workers hostnames oob-worker.cf100-3-.workers.dev and a DNS-TXT...

MAL-2026-13193 Malicious code in dolyame-ui-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 006f52fd18bda361d6e21e6a31e7cb0b7f07680374ffc81bd38f3abe0b3951c2 The package is published under a name suggesting a React UI text component, but its main entry index.js requires./init on module load, which acts as ...

MAL-2026-12849 Malicious code in bigops-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15f70a20d80478c350a3a0d94c3b66f8ba4804e4eb8e3f238393330d4569501 The package is advertised as a UI kit but ships no UI code. On require, index.js loads compat.js, which selects an OS/arch-specific payload path and...

Malicious code in blocks-sahred-atom-mobile-app-bar-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06fe2a177df3e33a917705f95afeb12c308bc01b65328114e5fa34411b210659 On require of this package, index.js exposes a trivial stub class and then loads bridge.js, which selects a platform-specific endpoint, fetches an...

Malicious code in beaver-ui-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f257786868c5d56c3f9f79e674980d07bfad3a42194819837623614554abb77 On require'beaver-ui-list', index.js loads ext.js, which selects a payload path based on OS and architecture, downloads a native binary from hardcode...