Malicious code in bnpl-blocks-stories (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04845144f2e54662acd3413698e57b4efbbe44c47ddeb3c40c2fcc7383ae572c On require of the package, index.js loads./ext which reconstructs hardcoded hostnames via fragment-joined arrays e.g. oob-worker.cf99-9b3.workers.dev...

Malicious code in boxy-debugger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2 boxy-debugger 35.3.4 presents itself as a debugger library, but requiring the package triggers platform.js, which reconstructs attacker-controlled...

MAL-2026-12647 Malicious code in claims-use-callback-once (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d807b141b53b48d7c3c104e9beb4904187499f289b79c1eda8f0bc91f8a1 On require of claims-use-callback-once, index.js unconditionally loads shim.js which selects a platform-specific payload path, fetches an executable...