MAL-2026-13556 Malicious code in dolyame-ui-carouselline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7712f1618991466bc33076081db37dd883be10f4c0c4308fe66216cece89a03 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct destination hostnames from string arrays e.g...

Malicious code in devplatform-react-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21349fd06b973a43dd3b8e7bbf1ec9c726d71fba81e1656410d718a3ef4b7e7e [email protected] is a dropper disguised as a React MCP SDK. On require, index.js loads helpers.js which assembles three Cloudflare Worker...

MAL-2026-13331 Malicious code in dolyame-boxy-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd3ad7593e26ae49876e0310a51ac122ddcb6878eefddc74a5828cce061d200b On require of the package, index.js loads init.js which assembles obfuscated Cloudflare Workers hostnames oob-worker.cf.workers.dev from string-split...

MAL-2026-12875 Malicious code in bnpl-blocks-atom-bnpl-feedback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058b0a78e0960f56198334ba1623fa948a0b198e4480910e73e44e48ad2704d0 On require'bnpl-blocks-atom-bnpl-feedback', index.js loads bridge.js which selects a platform-specific asset, downloads an unsigned binary via HTTPS...

MAL-2026-12644 Malicious code in claims-to-iso-string-with-timezone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c313bb681d365fedf6993c01c72c1e6e703b2b5124c8c35c19a730d5b2d4f7aa On require of claims-to-iso-string-with-timezone, index.js loads./init.js which downloads a platform-specific binary from obfuscated author-controlle...