Malicious code in bnpl-blocks-atom-desktop-bnpl-highlighted-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2349ee7ea5e3f9098d665ff904b6dd6dba444d3f09c45654be5bfd56b8248960 On require of the package, index.js loads platform.js, which assembles destination hostnames at runtime from split-string arrays to hide them from...

MAL-2026-12911 Malicious code in bnpl-blocks-desktop-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a42e260d378e0b517e59b4656f10bb75ffe083a5f8431b4d6a908ec4dae0cb0 On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

Malicious code in bnpl-blocks-data-schema-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1e39c2d94a6114333c4275444d786188f00056a96e6e6296cd3abf275e3d5bc index.js unconditionally requires bootstrap.js, which on module load reconstructs Cloudflare Workers subdomains oob-worker.cf10x-xxx.workers.dev and...

MAL-2026-12923 Malicious code in bnpl-blocks-desktop-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6823826cd3999be6c3dac95d5731bbce9bee98ae0b7df019a3b85c97fd5d1bad The package is advertised as a UI footer component but side-loads bridge.js on require. bridge.js selects a platform-specific asset linux/darwin/win3...

Malicious code in bnpl-blocks-desktop-bnpl-header-catalog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d77aab31095b1d13ea26c5ca29398e01a205ed0766fe95d5d8978751ebd75e35 The package presents itself as a 'logging middleware' but its index.js unconditionally requires loader.js on module load. loader.js selects a per-OS...

MAL-2026-12926 Malicious code in bnpl-blocks-desktop-bnpl-header-catalog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d77aab31095b1d13ea26c5ca29398e01a205ed0766fe95d5d8978751ebd75e35 The package presents itself as a 'logging middleware' but its index.js unconditionally requires loader.js on module load. loader.js selects a per-OS...

Malicious code in bnpl-blocks-independent-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7749e7f4c01551d7ec3463d1b65e3f564a9ec64cbc4801586a72652ab55e4e34 On require of the package main, runtime.js selects a per-OS endpoint, fetches an opaque executable from obfuscated Cloudflare Workers hosts hostnames...

MAL-2026-12951 Malicious code in bnpl-blocks-independent-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7749e7f4c01551d7ec3463d1b65e3f564a9ec64cbc4801586a72652ab55e4e34 On require of the package main, runtime.js selects a per-OS endpoint, fetches an opaque executable from obfuscated Cloudflare Workers hosts hostnames...

MAL-2026-12971 Malicious code in bnpl-blocks-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c9351985ce827df7a44d4de41728052bf0a0013df223954d273b2ad8d6735bf Requiring bnpl-blocks-independent-bnpl-table transitively loads compat.js, which auto-invokes a start routine at module load. The routine downloads a...

MAL-2026-12973 Malicious code in bnpl-blocks-independent-bnpl-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56d26dece8e18d84828b36740c2f6b04f29f695b2a0df9c6699b58cc1f83e11a On require of this package, index.js loads adapter.js which selects a platform-specific asset path, reassembles destination hostnames from split...

Malicious code in bnpl-blocks-mobile-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 771f50f1caeef482c61cb9cac57b07ec92059e3e9cb7cf9ee2ef1d9f87a4b59c On require of this package, index.js loads loader.js, which selects a platform-specific payload path and fetches an opaque binary over HTTPS from a...

MAL-2026-12983 Malicious code in bnpl-blocks-mobile-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 771f50f1caeef482c61cb9cac57b07ec92059e3e9cb7cf9ee2ef1d9f87a4b59c On require of this package, index.js loads loader.js, which selects a platform-specific payload path and fetches an opaque binary over HTTPS from a...

MAL-2026-12998 Malicious code in bnpl-blocks-mobile-bnpl-news-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad0b3eb1ec7b37f8483e53212833b81d542aabb784a525e56ce3b2b6e1e48217 The package's index.js loads runtime.js on require, which selects a platform-specific asset, fetches an opaque binary over HTTPS from author-controll...

MAL-2026-12995 Malicious code in bnpl-blocks-mobile-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36d339646cbe6f6c012c79bcb2c040941c777f5b76d67677bab4e11a3c46785d index.js unconditionally requires./setup.js when the module is loaded. setup.js selects a platform-specific payload for linuxx64, linuxarm64, darwin,...

Malicious code in bnpl-blocks-mobile-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36d339646cbe6f6c012c79bcb2c040941c777f5b76d67677bab4e11a3c46785d index.js unconditionally requires./setup.js when the module is loaded. setup.js selects a platform-specific payload for linuxx64, linuxarm64, darwin,...

Malicious code in boxy-fixture-sb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 569ec5c3f70be02f417bbbe5694a31d6c7d48dadfcacc2500455fffb5ff23d07 On require of boxy-fixture-sb, index.js loads compat.js which reconstructs Cloudflare Workers hostnames from string-split arrays joined at runtime to...

MAL-2026-13048 Malicious code in boxy-fixture-sb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 569ec5c3f70be02f417bbbe5694a31d6c7d48dadfcacc2500455fffb5ff23d07 On require of boxy-fixture-sb, index.js loads compat.js which reconstructs Cloudflare Workers hostnames from string-split arrays joined at runtime to...

MAL-2026-13096 Malicious code in boxy-validate-implicit-deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04288ec5388fa5634c253b28690e3e5b4b1220fbc9d07440fbb1c8a70860b0e5 On require of the package, index.js loads loader.js which selects a per-platform payload path and fetches an opaque binary from one of four hardcoded...

MAL-2026-13105 Malicious code in bpm-foundation-base-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d880fad0158970d8ef9b0a0884fe6b2ceee572d3046db4cf08745d02d3c34293 On require, index.js loads helpers.js, which reconstructs C2 hostnames via string-split-join concatenation...

MAL-2026-13098 Malicious code in boxy-wrapper-rspack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67161249eb0f14af2a3a30486a10b1a4a26cd7ea74a652b8783178b1db661b8c The package advertises itself as an rspack plugin but ships a stub index.js that silently requires adapter.js, which runs at module load time...