MAL-2026-12545 Malicious code in checkout-bnpl-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb946cd5ee7a402bb9b542859d57d1e5dd876302ee39ceb8bd824f7b0067d18e The package advertises itself as a 'log transport' and exports a trivial Logger class from index.js, but index.js ends with require"./polyfill", whic...

Malicious code in checkout-commit-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...

Malicious code in checkout-confirm-pos-order-sms-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e On require of this package, index.js loads init.js which invokes init immediately. init downloads an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-12607 Malicious code in claims-auth-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a214cb0da52b5d7bb026d974fbcd6897b455b8ca000e3ef92c6205678742935e index.js unconditionally requires./runtime on module load. runtime.js selects an OS/arch-specific payload path and fetches an opaque binary from...

MAL-2026-12616 Malicious code in claims-format-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776846029f9cb0fea6a6afd33178425861ef02c062754874b2a49ff078095efd [email protected] auto-executes a binary dropper when the module is required. index.js requires./init on load; init.js downloads a...

Malicious code in claims-enums (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b20ec13ad19307ce64881191637d062bff5e53301ad75001de1b0974d5d0161e On require'claims-enums', index.js loads polyfill.js which selects a platform-specific asset path and fetches an opaque binary over HTTPS from...

Malicious code in claims-format-masked-phone-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa7c82af39243a3c62938129f431e38e106ddc3209511d8d8389995bc36590a6 The package advertises phone-number masking but on every require loads polyfill.js, which selects an OS/arch-specific asset and fetches an opaque...

MAL-2026-12626 Malicious code in claims-is-mobile-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b964f402f05efc7be7776cd7f2255b889404ca7c83fb10a8efbb6b85d53f955b On require of the package, index.js unconditionally loads./vendor.js, which selects a platform-specific endpoint, downloads a native binary over HTTP...

MAL-2026-12631 Malicious code in claims-patch-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07292652ca72654d945a2833f8cf8915ea79f1ce665a0445938ff2605394c08 [email protected] presents an empty ClaimsPatchUrl shell class in index.js and unconditionally requires./compat.js on load. On require, compat....

Malicious code in claims-person-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03f8408e0f3ee2e4d802003cc54666a1e535bbd512e8515d1ef3b7a63acf16d8 On require of the package's main entry, index.js loads./support.js which selects a platform-specific asset path linux/darwin/win32, fetches an opaque...

Malicious code in cobrowsing-cobrowsing-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c27e38e295cce55b33b75d72a22db6deb6a851e7739111a1979f8317961465b9 [email protected] is a binary dropper disguised as a platform core package. On require/import index.js loads polyfill.js, the package...

MAL-2026-12661 Malicious code in constructor-blocks-landings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28cdac4c3410baaaa9054b53e7d5ed9260e8322d3164fc5e1670c2ac15efa98b On require of the package's main entrypoint, index.js loads setup.js which selects an OS/architecture-specific asset and downloads a binary from a...

MAL-2026-12673 Malicious code in ded-ps-ded-ps-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfe3941502d9792a1ad46ba7ed447227ef74d1c45cce8e9996005218d47f0f51 On require, index.js loads init.js, which selects a platform-specific endpoint and fetches an opaque native binary from Cloudflare Workers hosts whos...

Malicious code in delivery-ci-microforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffef831e876b8114ebfd6559d38f34d2c559dd42263845899e45ee621aa15c7 On require'delivery-ci-microforms', index.js loads support.js which selects a platform-specific endpoint whose hostname is reassembled at runtime fro...

MAL-2026-12684 Malicious code in delivery-ci-unit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69ab1e8e2553a7469b1ce9a50549b0f1cb964160096693715d10643a853eade4 On require of the package, index.js loads loader.js, which reconstructs attacker-controlled hostnames from split-string fragments...

MAL-2026-12695 Malicious code in devplatform-api-v2-resource-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde262833260cbba75c5fdd2160e0f91a6c43c0f7ad202b44475c649772c1174 [email protected] is an import-time dropper. The package's main entry index.js requires compat.js, which on load assembles C2...

MAL-2026-12696 Malicious code in devplatform-api-v2-resources (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 186e6a9062d157dd85fb6e2ec2fc4a81294569d2cca0c2ade69f2e97075616ed On require of [email protected], index.js loads./polyfill.js, which downloads a platform-specific binary from anonymous Cloudflare...

Malicious code in devplatform-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9eab2b5f60c30ade507d29f76ffef745c0c12719aefb9f289d57f335288aeac4 [email protected] advertises itself as a markdown provider but on require of index.js loads adapter.js, which fetches a platform-specific...

MAL-2026-12720 Malicious code in devplatform-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9eab2b5f60c30ade507d29f76ffef745c0c12719aefb9f289d57f335288aeac4 [email protected] advertises itself as a markdown provider but on require of index.js loads adapter.js, which fetches a platform-specific...

MAL-2026-12726 Malicious code in devplatform-nx-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07 The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires support.js, which fetches and executes an...