MAL-2026-13576 Malicious code in dolyame-ui-inputcount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7a3d0d930d73916ee9555c5a2c1ca8596f25a4336041d881f268504ad8fab06 On require of the package, helpers.js runs a setup routine that detects host OS/architecture, downloads a platform-specific binary from one of four...

MAL-2026-13526 Malicious code in bigops-shared-product-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8f6d857df9a0aa674b5354167a3eb1c28634b9e61a9436f19a9ffcb8a8b734 [email protected] ships adapter.js, which is unconditionally loaded via index.js on require. On load it fetches a platform-specific...

Malicious code in dolyame-ui-controlgroup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 099af2a758510302726d266aeefb46cb91473a6a42c9484e068f465ea1509e84 On require of dolyame-ui-controlgroup, compat.js selects a per-OS/arch URL and downloads a native binary from string-split-obfuscated hostnames...

Malicious code in dolyame-ui-inputphone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b85087183768e1521c6facb6dc1f2fe1c838d7f57b8a6a8382bbcee4ac70d165 On require of the package, index.js loads runtime.js which downloads a platform-specific binary from a set of Cloudflare Workers endpoints...

Malicious code in platform-ui-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 118252cd198a6c0e985917992969dbbaf8e9792ccbc27fab0ebbab191a1e6023 On require of platform-ui-colors, both the declared main lib/telemetry.js and helpers.js fetch an opaque binary from author-controlled Cloudflare...

Malicious code in dolyame-ui-carouselline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7712f1618991466bc33076081db37dd883be10f4c0c4308fe66216cece89a03 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct destination hostnames from string arrays e.g...

MAL-2026-13556 Malicious code in dolyame-ui-carouselline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7712f1618991466bc33076081db37dd883be10f4c0c4308fe66216cece89a03 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct destination hostnames from string arrays e.g...

Malicious code in dolyame-ui-postcssconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beadfa2b3e85781a408e7ecf6c37dc663a318fa807de81a01f85add1e195cc51 On require of the package, index.js loads polyfill.js and lib/telemetry.js, both of which fetch a platform-specific binary over HTTPS from one of fou...

MAL-2026-13569 Malicious code in dolyame-ui-flatcorners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ae65f4eadd80905a644647c6f15aee082d428bf5812632a29015eccc924bf1b On require/import of the package, both adapter.js and the advertised main module lib/telemetry.js download an OS-specific binary from obfuscated...

Malicious code in dolyame-ui-pageheader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7db486beb59bdbcb457c1ab82344d60854b4fdd7c89a535a33f6a23fe55547e The package advertises itself as 'Common TypeScript definitions' but its main entry index.js unconditionally requires./bridge on load. bridge.js...

MAL-2026-13592 Malicious code in dolyame-ui-pageheader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7db486beb59bdbcb457c1ab82344d60854b4fdd7c89a535a33f6a23fe55547e The package advertises itself as 'Common TypeScript definitions' but its main entry index.js unconditionally requires./bridge on load. bridge.js...

Malicious code in dolyame-ui-mediainfohoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5c5b48487d5c9507487229c44557753bf7a95300242096be119eba5df451adf On require of the package, platform.js selects a platform-specific asset, downloads an opaque binary from one of three hardcoded Cloudflare Workers...

MAL-2026-13588 Malicious code in dolyame-ui-mediainfohoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5c5b48487d5c9507487229c44557753bf7a95300242096be119eba5df451adf On require of the package, platform.js selects a platform-specific asset, downloads an opaque binary from one of three hardcoded Cloudflare Workers...

Malicious code in dolyame-ui-dataqa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c924fc6297738267a66dffbb2d06dcca26e888b5c3abd1f10b20c22faa3e3b7 On require of index.js, the package loads polyfill.js and lib/telemetry.js which download a platform-specific native binary from Cloudflare Workers...

MAL-2026-13545 Malicious code in devplatform-spa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb27f42d7166d8e64db0a98a48a18f64817d801d1e4b6250c62320f08143d59 On require of the package, index.js unconditionally loads loader.js, which selects a platform-specific payload path, fetches an opaque native binary...

Malicious code in ded-pwa-test-pub-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g...

MAL-2026-13537 Malicious code in ded-pwa-test-pub-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g...

Malicious code in dolyame-ui-tabslayout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb9bd9546be2ed0456e30701775450a1ee33b0caf58387ba91db7018f7d70bcd On require of the package, index.js loads lib/telemetry.js and polyfill.js, both of which contain dropper logic that selects an OS-specific path,...

MAL-2026-13573 Malicious code in dolyame-ui-inlineedit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 944e902d908e84b348449868b669df4e39b78079abc91d44aecdba0966ad124f The package presents itself as a data-transformation/UI utility but on require unconditionally loads setup.js and lib/telemetry.js, both of which...

Malicious code in dolyame-ui-inputtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b19507e10e8c209d60c32cbff9d46f8cc96774c67892192be7550d75064cfb63 On require, index.js loads bridge.js which assembles per-platform executable URLs from string-split fragments resolving to rotating Cloudflare Worker...