Malicious code in dolyame-boxy-independent-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfda80d3053a8c106f2665b5c1a9a9235532a4acca7abd2a436b5c69fe7673d6 On require of the package's main entry, runtime.js fetches an opaque native binary from anonymous Cloudflare workers.dev subdomains...

Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from...

MAL-2026-13308 Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from...

Malicious code in dolyame-boxy-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-boxy-mobile-bnpl-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce4829363e0b5248ca374f2bd545b219d5235bbc96936ba5bd9d06f369878538 On require, index.js loads shim.js which selects a platform-specific endpoint from a set of runtime-assembled Cloudflare Workers hosts...

MAL-2026-13135 Malicious code in dolyame-ui-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3df9ea5c492e81553a008ca4fbc71c2c4824b6278bb6a81f11d5e8dc005f561e On package load, index.js requires./platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

MAL-2026-13133 Malicious code in dolyame-ui-accordion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a72f168a8501a4518ddfc5cdda24be49bfa8effefbf72fa490bbaa57daa3637 The package is advertised as a React accordion UI component but on require unconditionally loads vendor.js, which downloads a platform-specific binar...

Malicious code in dolyame-boxy-stories (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0ef68742c490f223f00748b7f5dc82d614231b0d68e430736bbaac9175035e4 On require, index.js loads bridge.js which selects a platform-specific endpoint and downloads a binary from one of three attacker-controlled hosts...

MAL-2026-13131 Malicious code in dolyame-boxy-stories (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0ef68742c490f223f00748b7f5dc82d614231b0d68e430736bbaac9175035e4 On require, index.js loads bridge.js which selects a platform-specific endpoint and downloads a binary from one of three attacker-controlled hosts...

MAL-2026-13124 Malicious code in ded-aa-liza-ded-aa-liza-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074f0a8014fabe8bdb281c1c07180290bcff2b10d67d723f1c7917ea198d5c5a On require of ded-aa-liza-ded-aa-liza-core, index.js loads ext.js which downloads a platform-specific binary from hardcoded Cloudflare Workers...

MAL-2026-13141 Malicious code in dolyame-ui-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a12afad0ec2643334f24431df3b2ba84584a9569bca025b50ef52feb6b9493 On require of the package's main entry, shim.js selects a platform-specific payload path and downloads a native binary from one of three Cloudflare...

Malicious code in dolyame-ui-draggable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81324df09668ea22833f1cff69d3e861bbb0644e5f231028ef2ea8ba0f9b8631 The package advertises itself as a UI toolkit, but its main entry requires./runtime.js, which on load downloads a platform-specific binary from...

Malicious code in dolyame-ui-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ebf602f046406a056b2d9d36768cf4592ae2f8a02375b0fdb5212c3cc1e80ca On require of dolyame-ui-footer, index.js loads./runtime.js which selects a per-OS payload path, fetches a binary via HTTPS from one of three hardcod...

MAL-2026-13154 Malicious code in dolyame-ui-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 171758619b11932bfa2790206d34ea6322b3985c9cfe083915c41fdb5b18f9ed [email protected] is advertised as a UI toolkit but its main entry loads platform.js, which on require assembles destination hostnames at...

MAL-2026-13152 Malicious code in dolyame-ui-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78e2cf3af799e05f20494aba04b5d85aa1335bce541af4cb13aa715a2cda6ea5 On require'dolyame-ui-dropdown', index.js loads helpers.js which selects a platform-specific endpoint from an obfuscated split-literal host list...

Malicious code in dolyame-ui-pie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f473b4f8898130c8b57fd3a129bf81a38b449ea8970e58a6e4c486943eb5579 Requiring the package triggers async initialization in support.js that downloads a platform-specific binary linux x64/arm64, darwin, win32 from...

Malicious code in dwhetlfront-dwhetlfront-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fad333b1a33066fabeca9799bee065c5d6431467699a187a25d6ef56a9cbea7f On require of the package, index.js loads support.js which selects a platform-specific payload URL, downloads bytes from Cloudflare workers.dev hosts...

MAL-2026-13202 Malicious code in dwhetlfront-dwhetlfront-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fad333b1a33066fabeca9799bee065c5d6431467699a187a25d6ef56a9cbea7f On require of the package, index.js loads support.js which selects a platform-specific payload URL, downloads bytes from Cloudflare workers.dev hosts...

MAL-2026-13195 Malicious code in dolyame-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c23ba8923130746ecc1e526c3a0ee8961ea764dd90d0da71236444d978ce27 dolyame-ui-themes ships a loader.js that is required from the package main index.js at module load. The loader reconstructs C2 hostnames from split...

Malicious code in beaver-ui-side-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868e87654c2af06a8362918fbcd52680c253a85063f1a0c7fc71494b0cfd304d On require/import of the package, index.js unconditionally loads helpers.js which fetches a platform-specific binary from attacker-controlled...