Malicious code in dolyame-ui-deprecatepropshoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7018f3772c1649d5a6ffd391a2aa36f4dcf5a57cbe5952f8bbc91c4ac3f7226 On require, [email protected] side-effect-loads adapter.js and lib/telemetry.js, which assemble Cloudflare Workers hostnames from...

MAL-2026-13566 Malicious code in dolyame-ui-deprecatepropshoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7018f3772c1649d5a6ffd391a2aa36f4dcf5a57cbe5952f8bbc91c4ac3f7226 On require, [email protected] side-effect-loads adapter.js and lib/telemetry.js, which assemble Cloudflare Workers hostnames from...

Malicious code in dolyame-ui-datatable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 730797abef8484a4993cfa7241f5b4ac3c407e837b182e3d117448941b7eaf33 The package's main entry requires platform.js, which on load downloads a platform-specific binary from anonymous Cloudflare Workers subdomains...

MAL-2026-13559 Malicious code in dolyame-ui-collapseblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-13594 Malicious code in dolyame-ui-postcssconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beadfa2b3e85781a408e7ecf6c37dc663a318fa807de81a01f85add1e195cc51 On require of the package, index.js loads polyfill.js and lib/telemetry.js, both of which fetch a platform-specific binary over HTTPS from one of fou...

MAL-2026-13573 Malicious code in dolyame-ui-inlineedit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 944e902d908e84b348449868b669df4e39b78079abc91d44aecdba0966ad124f The package presents itself as a data-transformation/UI utility but on require unconditionally loads setup.js and lib/telemetry.js, both of which...

Malicious code in dolyame-ui-inputcolor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd621d8f38bf9cc61f7de47b10d8ef68fe086c42508366989552992e0bb8238 index.js unconditionally requires./loader on load. loader.js assembles attacker hostnames at runtime via array.join to hide them from static scanners...

MAL-2026-13513 Malicious code in eacq-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fdb6bb562df94959130d84e06dc14aa40e9347c60da24dd32ce672024c2e0aa Requiring the package executes init.js, which selects a platform-specific payload path and fetches an executable over HTTPS from Cloudflare Workers...

MAL-2026-13515 Malicious code in eacq-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af2bcb4382f02a977f8448ea4f0172253035755b2d1dc363cce80f0389a1ee70 [email protected] contains a dropper reachable both from setup.js and from the main-exported lib/telemetry.js loaded on require'eacq-dialog'. The co...

Malicious code in eacq-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af2bcb4382f02a977f8448ea4f0172253035755b2d1dc363cce80f0389a1ee70 [email protected] contains a dropper reachable both from setup.js and from the main-exported lib/telemetry.js loaded on require'eacq-dialog'. The co...

MAL-2026-13494 Malicious code in bigops-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccbd56ae20f9cc922c12df25456654a649c9bbc963aae4fa95e027f97628c45b Requiring the package index.js -./setup triggers setup.js, which reconstructs destination hostnames from split string fragments e.g...

Malicious code in eacq-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b500358c69db5b11d186a6656bd7e20b6ae98cf8f8b437af7b320d511f870761 On require of eacq-core, both helpers.js and lib/telemetry.js download a platform-specific binary from Cloudflare Workers hosts assembled at runtime...

Malicious code in vite-svg-parse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f6b581f4ab8d027c727649fae10749a9ac9a59af4619f5576362ab9243cb6c6 The package's exported API getPlugin/setPlugin decodes two base64 string literals at runtime: the first decodes to npm install node-internal-svg-load...

Malicious code in poc-ch4rlygr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 341e5cb63d816ed6a8ed092f3b174e9826e10d051d8e78a53f0564b1437d0e04 On require/import, index.js collects os.hostname, os.arch, dirname, os.userInfo.username, and the full contents of process.env serialized via...

Malicious code in bigops-nitro-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfbd116994566a3e99f61697a738787d8089c2c99dbc9d5c55f9f3902a6b8cff On require, index.js loads vendor.js which downloads a platform-specific native binary from rotating Cloudflare Workers endpoints...

Malicious code in bigops-microfrontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53767eeec6e6f398e15ba75b3143b7fba8eb0a803579e2788a55163393bb2789 index.js unconditionally requires./shim on load. shim.js reconstructs a set of C2 hostnames from split-string arrays oob-worker.cf99-9b3.workers.dev,...

Malicious code in bigops-opening-file-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39 On require of bigops-opening-file-handler, index.js loads support.js which selects a platform-specific asset linux/darwin/win32 and downloads an opaq...

MAL-2026-13229 Malicious code in bigops-opening-file-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39 On require of bigops-opening-file-handler, index.js loads support.js which selects a platform-specific asset linux/darwin/win32 and downloads an opaq...

Malicious code in bigops-operator-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a On require of this package, index.js loads support.js which selects a platform-specific asset path linux/darwin/windows, fetches a binary payload fro...

MAL-2026-13239 Malicious code in bigops-products-deposits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5f53755fd64cd249daeb83c1f148b5f4e600e4f59cc07cfa99fe6579992b0a9 On require of this package, index.js loads runtime.js which auto-invokes an init routine that selects a platform-specific endpoint, downloads a binar...