Malicious code in bnpl-blocks-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5181e44b181b008c8345153784c66020faa73f1f591fc070a1f20f105ba8f2c6 The package presents itself as a fonts helper but its index.js unconditionally requires./ext, which on module load fetches a platform-specific binary...

Malicious code in bnpl-blocks-independent-bnpl-items (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b068b10c6608e86812242f222c2936a85aae90776b6c71298731c16f8d7ae31 On require of this package, index.js loads runtime.js which selects a platform-specific asset, fetches an opaque binary from one of three obfuscated...

Malicious code in bnpl-blocks-independent-bnpl-mobile-application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 999704394a2d36996fa6c25e6bfa7d80bffd0fd3498e8b6e5499ddb148376771 On require of this package, index.js loads adapter.js which selects a per-platform payload linuxx64, linuxarm64, darwin, win32, downloads bytes from...

Malicious code in bnpl-blocks-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c9351985ce827df7a44d4de41728052bf0a0013df223954d273b2ad8d6735bf Requiring bnpl-blocks-independent-bnpl-table transitively loads compat.js, which auto-invokes a start routine at module load. The routine downloads a...

Malicious code in bnpl-blocks-independent-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bc1ec9ae3c3510564b412ad20157f80b59ebe816ceda37ee01a3a46fd146b3f On require of this package, index.js loads compat.js which unconditionally bootstraps a dropper. It selects a platform-specific payload path, fetches...

MAL-2026-12968 Malicious code in bnpl-blocks-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 386248e103371d4e302c8325a3d1b76c4269256b1c374c95f539104230f60149 The package ships a loader loader.js that assembles remote hostnames at runtime from string-split arrays reconstructing subdomains of wel1.ru and a...

Malicious code in bnpl-blocks-mobile-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f511a9eac93e0ef06eeec5ab7ec22330cb092c4fda952ec540f4a9be3fc522f On require of the package, index.js loads bridge.js which fetches an OS-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12996 Malicious code in bnpl-blocks-mobile-bnpl-link-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6203d02c8bfb651950b571dd342ff82e154a3c3867af751a7fb1facdb5bd0f5 On require of the package, support.js selects a platform-specific asset path and fetches a binary over HTTPS from obfuscated .workers.dev hosts...

MAL-2026-12990 Malicious code in bnpl-blocks-mobile-bnpl-grid-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 792cb2358938b5e58ee7cd132526e95184827417dd7d66c21d6e9ae281145a70 On require of the package, index.js loads runtime.js, which assembles a rotating list of C2 hostnames from array-joined string fragments resolving to...

MAL-2026-13007 Malicious code in bnpl-blocks-mobile-bnpl-tab-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34cc219a990162733e49aafc255a8abe4c4acd3fc56bce77ae31800fd4791678 On require of the package, index.js side-loads adapter.js which selects a platform-specific asset, downloads bytes over HTTPS from hostnames...

MAL-2026-13012 Malicious code in bnpl-blocks-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b85856c1395372c88e148fdabb77be27f0556ad68ba3eb7f5c62d063a9154607 On require'bnpl-blocks-playwright', index.js loads bridge.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains...

Malicious code in bnpl-blocks-mobile-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6a276d26c910b007ca066878179b48828a21822a3d4fb4a711604700a537f9 On require of this package, main resolves to runtime.js, which assembles Cloudflare Workers hostnames by string-splitting...

Malicious code in boxy-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d0a7cd9dacffcb1188a7f6dfdde918d6ef5ba334e773f44330c93f4dd38ddf On require of the package, index.js unconditionally loads runtime.js, which fetches an OS-specific binary from attacker-controlled hosts under...

MAL-2026-13039 Malicious code in boxy-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d0a7cd9dacffcb1188a7f6dfdde918d6ef5ba334e773f44330c93f4dd38ddf On require of the package, index.js unconditionally loads runtime.js, which fetches an OS-specific binary from attacker-controlled hosts under...

MAL-2026-13065 Malicious code in boxy-maker-sticky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc3701b8f91a045a21b2a07ba76082afea03e4aea2c9a87a1c1e40e2de88c3b0 On require of boxy-maker-sticky, index.js loads runtime.js which reconstructs C2 hostnames from split string fragments...

Malicious code in boxy-sticky-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc08631cb79f90d5440020f420e9c7ad9e67ec84f25f085825c5b5f600f613a4 On require of the package, init.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at runtime from...

MAL-2026-13091 Malicious code in boxy-test-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a5cc17bc186bfb165d7341ea7832b66bc93cafaa6f849ccc840660735c0cfa5 On require of the package, index.js loads ext.js which assembles C2 hostnames from split string fragments oob-worker.cf102-baf.workers.dev,...

Malicious code in boxy-scroll-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c713e8e4ae3018f2614b7185c98b1f86dffcb684387e6a454d30a2c6eb8b89db On require of boxy-scroll-providers, index.js loads bootstrap.js which selects an OS-specific endpoint, downloads an opaque binary from obfuscated...

MAL-2026-13080 Malicious code in boxy-search-workspace-substrings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e86dee583e9f4fb1f10351062e6b4a9ddb6b4eae29b59677c1e8f4bf04711b6 On require of the package, index.js silently loads loader.js wrapped in an error-swallowing try/catch. loader.js reconstructs a set of destination...

Malicious code in boxy-validate-implicit-deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04288ec5388fa5634c253b28690e3e5b4b1220fbc9d07440fbb1c8a70860b0e5 On require of the package, index.js loads loader.js which selects a per-platform payload path and fetches an opaque binary from one of four hardcoded...