Malicious code in dolyame-boxy-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts...

Malicious code in bnpl-blocks-atom-bnpl-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9b4cea9f3ecb85954dffb42aac8b9869e662493ae87815a7feb8c293e398b79 On require of the package, index.js loads./platform.js which fetches an opaque executable payload from obfuscated Cloudflare Workers hosts...

MAL-2026-12393 Malicious code in invest-module-cookie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3f53c4d50d2dedd530c65015b26a902950e6e2bbef3cda3560a661d4aad178 On require'invest-module-cookie', index.js loads adapter.js which selects an OS-specific asset path, downloads an opaque binary from one of three...