MAL-2026-13642 Malicious code in sme-rko-finance-front-operations-other (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c11dc6f375e9ceaee8f1b8e40db07f49c88e7bc47715759b101d3513399047be On require/import, init.js selects an OS/arch-specific binary and downloads it from a rotating set of Cloudflare Workers hostnames...

MAL-2026-13494 Malicious code in bigops-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccbd56ae20f9cc922c12df25456654a649c9bbc963aae4fa95e027f97628c45b Requiring the package index.js -./setup triggers setup.js, which reconstructs destination hostnames from split string fragments e.g...

Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

MAL-2026-13282 Malicious code in dolyame-boxy-atom-bnpl-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ecc1e21adbb7890afdc37d9e00e09d56b9b66fc9793603884569d8beed29d7 On require of dolyame-boxy-atom-bnpl-badge, helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors...

MAL-2026-12839 Malicious code in bigops-tcrm-permissions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a20b19aa6d3666cf99d03011aefd683f0d560b45dac6f27c2915dd68dd95bc0d On require of bigops-tcrm-permissions, index.js loads runtime.js which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in bnpl-blocks-consts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7651f2c7c9ce4e13909a22f522b625f2bcf6825ced0641259c77e9d46ab56ede Package is advertised as a constants wrapper but requiring it loads polyfill.js, which on import asynchronously downloads a platform-specific...

Malicious code in bnpl-blocks-mobile-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e19ad8f13f3c9f4ab6b31c65bad3fb1239ad816c040504428eae8c32740869c index.js unconditionally requires helpers.js, which on module load fetches a platform-specific binary from string-split-obfuscated Cloudflare Workers...

Malicious code in boxy-maker-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a06d379928c2633009c8dc7d89921205689ffb6ed8fa03ba74f67f557836c6f4 [email protected] executes a remote binary dropper the moment the module is loaded. index.js unconditionally requires polyfill.js, which selec...

Malicious code in cobrowsing-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea index.js unconditionally requires adapter.js on load. adapter.js reconstructs destination hostnames from string-split fragments assembling...

Malicious code in delivery-ci-tech-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63eae2afeb5a45d70f1d217049ab813392464cc8fb099462c716b8573836ed6b On require of the package, index.js loads support.js, which reconstructs hardcoded destinations from split string arrays...

MAL-2026-12745 Malicious code in devplatform-rest-resources-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a9f72a6d741b5f055738486ee936f61ff645ed6dfdb0e34e746195da5b0d03 On require of the package, index.js loads bootstrap.js which selects a platform-specific endpoint, fetches an opaque native binary over HTTPS from...

Malicious code in pfa-prettier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08f4b65c7534427cd8814e8c85a84b11c2201d10724c34bb99987bae83e0c5cc The package is published as 'pfa-prettier-config' with description 'environment config reader', but contains no Prettier configuration or...

MAL-2026-12209 Malicious code in statist-browser-typed-client-ddp.mentat.ui.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dc78a545236395c12156cd5f8e36337df53024afd0a6a6da75f81fb9b7c11e7 The package's main entry index.js loads polyfill.js, which on module load detects OS and architecture, fetches a per-platform binary over HTTPS from...

Malicious code in twork-mf-e2e-nitro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eba320ce2333e7bd477470ded20a2be52a334069c482ab957b41772f347f63d On require of the package, index.js loads compat.js which reconstructs Cloudflare workers.dev hostnames via split-string array concatenation...

Malicious code in scrollbar-hide-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f19e1731b591552a096b108703702b9663c1bbb8cf9c2ff6fc048f8582e8607 The package's main entry dist/index.js appends an obfuscated payload — wrapped in evalatob... with require targets and URLs hidden in \uXXXX escapes ...

MAL-2026-12233 Malicious code in tinkoff-boxy-independent-kasko-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 873f98d16d6e9c4ecb2f5919621cfa940fe0059c48de29b1bb0eff6420527afc On require of the package, index.js loads bootstrap.js which reconstructs hardcoded hostnames via split-string.join obfuscation and downloads a...

MAL-2026-12076 Malicious code in tinkoff-cache-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9db3a162bd8fe3b6112b6d058e42245617122a41941d0b3a818254aba25ce59b The package advertises itself as an in-memory cache utility, but index.js unconditionally requires compat.js on load, which acts as a dropper...

MAL-2026-10526 Malicious code in @vite-pro/vite-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9aaf307faea8efb93af6f3c8ee4811304a7d9afa25f1c9525aed108efea439e7 Package @vite-pro/vite-ui impersonates the official vite package: package.json declares author Evan You, points repository at github.com/vitejs/vite,...

MAL-2026-6307 Malicious code in @glitchpad/throttler (npm)

@glitchpad/throttler malicious version 2.2.3, published by [email protected] is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accounts all follow the pattern...

Malicious code in @glitchpad/throttler (npm)

@glitchpad/throttler malicious version 2.2.3, published by [email protected] is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accounts all follow the pattern...