Malicious code in devplatform-spa-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6127d0c2ccf2b21fdd6f22244b040c905b2296c86c47cc3c4eb012b61a4c455a On require, index.js loads support.js, which assembles Cloudflare Workers hostnames oob-worker.cf.workers.dev and fallback domain sdk.dl.wel1.ru at...

MAL-2026-12409 Malicious code in pfp-block-mobile-past-meetup-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf58f1cbe01e2a0634ec464f040fc08dadf2df035af8c8a68d1fea1d51f10a85 On require of pfp-block-mobile-past-meetup-list, index.js loads ext.js which runs a bootstrap routine. It fetches a platform-specific binary via...

Malicious code in pfa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e06752c5f827cccdf98f23fa26d893d44e2889b8b7011e8fdb130524f09fe0f On require'pfa-errors', index.js unconditionally loads runtime.js, which fetches a platform-specific opaque binary from one of three hardcoded...

MAL-2026-12476 Malicious code in tcb-web-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115bda849ee7aff33e1ccc649f492e892e31243bfb026eea8048c158c885bdf0 On require of tcb-web-header, platform.js selects an OS/arch-specific endpoint, downloads a binary from Cloudflare workers.dev hosts whose names are...

MAL-2026-12374 Malicious code in eventea-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8a332e38d2400d3c15f34636f55191ca61c1d52ff49fbead378b9f9239de756 index.js unconditionally requires vendor.js on load. vendor.js selects a platform-specific payload path, downloads an opaque native binary over HTTPS...

Malicious code in cardsmobile-collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 103c6f5e66de4d466d79c8a4247f46670fad0de2601a93f37fa6280c5491cc41 On require of the package,./runtime.js runs a top-level setup that downloads a platform-specific binary from string-concatenated hostnames...

MAL-2026-12412 Malicious code in pfp-forms-independent-sme-glossary-anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c96f28993eb59bb78a357534cf64aac001732fc4951ccb33f8eca2a3ce615f3c On require of the package, index.js loads compat.js which reconstructs mirror hostnames via string-splitting joins oob-worker.cf102-baf.workers.dev,...

MAL-2026-12456 Malicious code in statist-statist-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 192fac66540fb5d3f4c376673ddd67a4e43053342e745e538f7ddcc08b0a9042 index.js requires./setup on module load. setup.js assembles obfuscated destination hostnames from split string arrays, selects a platform-specific...

MAL-2026-12453 Malicious code in statist-browser-typed-client-sme.rko.finance.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f8aa3f187231d6a828b8d3cd99eee3f0b3dbb95abecc8ebf1add2c393f59b15 On require of the package, support.js assembles remote hostnames from split-string array joins e.g. "oob-wo","rker.cf1","02-baf.workers.","dev".join"...

Malicious code in express-mongo-santi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose ...

Malicious code in accounts-limits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69c43a5fbac213b36e4a3d7c25d7f41311e6f3f111f3b175e2f306077afbcde0 index.js unconditionally requires./runtime.js, which on module load selects a per-platform asset path, fetches an opaque binary from one of three...

MAL-2026-12134 Malicious code in accounts-limits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69c43a5fbac213b36e4a3d7c25d7f41311e6f3f111f3b175e2f306077afbcde0 index.js unconditionally requires./runtime.js, which on module load selects a per-platform asset path, fetches an opaque binary from one of three...

MAL-2026-12229 Malicious code in tinkoff-boxy-desktop-mgm-product-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5a7c457a57706b708f2b1e45df0c9746088cbdbb9eaacc598536017272a547 The package's index.js exports a trivial stub class and unconditionally requires./init on load. init.js reconstructs network destinations at runtime ...

MAL-2026-12305 Malicious code in twork-products-taiga2-products-investment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64ab6e4ef4d1c4dafd75af4c52d747069dd76fa1ba8d958f2c82ba7fba2e8a0 On require of the package, init.js unconditionally loaded from index.js fetches a platform-specific executable from one of three obfuscated Cloudflar...

Malicious code in bigops-voximplant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e20e151930946a17e9bea02eb51c760264c27138792955452acc4231196ceaae On require of bigops-voximplant, index.js loads ext.js which downloads an OS/arch-specific binary from Cloudflare Workers subdomains whose hostnames...

MAL-2026-12168 Malicious code in bigops-frontend-bigops-frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb3c97636fded3935088ac125f923882844470f5638c45176b4254d4dbad714 On require of the package, vendor.js downloads a platform-selected native binary from hardcoded Cloudflare Workers hosts...

Malicious code in sotqa-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6980ae2860be6b9f343e9705a5415dc9ea13a81d285c1dce1f2f56b3dc989fbd On require, sotqa-test loads bootstrap.js which reconstructs C2 hostnames from split-string arrays joined at runtime oob-worker.cf102-baf.workers.dev...

MAL-2026-12069 Malicious code in nxify-unic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2645ab342655ef98b8905299be8fc515978b43f6cf36ae564c9da827227dd391 On require'nxify-unic', index.js loads shim.js which detects OS/architecture, assembles destination hostnames at runtime by string-splitting and...

MAL-2026-12042 Malicious code in platform-ui-island (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e678a3a4d4b9e16e6d6223aaa0c6ccaca9b7f2ac95e47940af4e706548e0f111 The package's index.js unconditionally loads bridge.js on require. bridge.js downloads a platform-specific native binary from obfuscated Cloudflare...

MAL-2026-10552 Malicious code in eth-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f051957ac6f91e8567df873978b45c0c81a170f94decbd735d329f312ff1bb On require, index.js schedules a 37-second delayed routine that reads test/fixtures/keypairs.dat, base64-decodes it into /.cache-db/.node-sync/syncd....