MAL-2026-13562 Malicious code in dolyame-ui-contextmenusearchable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 391ae77ec9b34917f01d44186bbafde2f290fc34d102a16a6106ef2a484314a0 On require, shim.js reconstructs hostnames via string concatenation to hide destinations oob-worker.cf.workers.dev, with a DNS TXT-record base64...

Malicious code in dolyame-ui-inputpassword (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbe3efece732cd0eab0df9c3fa387540804b7a1f7a911a340c3852e7f2c54674 On require of the package, index.js loads lib/telemetry.js which, together with bootstrap.js, fetches a platform-specific binary from a rotating list...

MAL-2026-13298 Malicious code in dolyame-boxy-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 919c54c4e8e0b08b62f76b85369a9033929f8ea19dfc777b8ece48697229a5ce [email protected] ships a runtime.js module that is unconditionally required from index.js at load time. On import, runtime.js reconstructs...

MAL-2026-13324 Malicious code in dolyame-boxy-independent-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation...

Malicious code in dolyame-boxy-stories-of-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e18c95ca0abb6765cd4e9eb0ac8661962453f51c14d55902402a3b861d8ff16 On require of the package's main entry, index.js unconditionally loads support.js, which reconstructs hostnames from split-string arrays e.g...

Malicious code in dolyame-ui-popover (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ed3996792c8c70963eee2871d056f13b90e873087ff77be677c7cb359058b9f On require of the package, index.js loads ext.js which selects an OS/arch-specific endpoint and downloads a binary from hardcoded Cloudflare Workers...

Malicious code in dolyame-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c23ba8923130746ecc1e526c3a0ee8961ea764dd90d0da71236444d978ce27 dolyame-ui-themes ships a loader.js that is required from the package main index.js at module load. The loader reconstructs C2 hostnames from split...

Malicious code in bnpl-blocks-desktop-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a42e260d378e0b517e59b4656f10bb75ffe083a5f8431b4d6a908ec4dae0cb0 On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

MAL-2026-12929 Malicious code in bnpl-blocks-desktop-bnpl-image-with-caption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c639b4f00dd3629a927a4892681ebf399a957fe793132521d781bd9cc0ed0da On require of this package, index.js loads ext.js which selects a platform-specific asset name and downloads a native binary from obfuscated Cloudfla...

MAL-2026-12938 Malicious code in bnpl-blocks-desktop-bnpl-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaa5e2ca983c49eefb3d32e333435a236f63c2d896ac41aed7b56114c477964c On require, index.js loads init.js which reconstructs a set of hostnames from split-string fragments e.g...

Malicious code in bnpl-blocks-mobile-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3362a69d0a3341fff7a48ebdd4a8231ec5a365dc237c62a5b95619fe051e762 On require, index.js loads bootstrap.js, which selects a per-platform payload path, fetches a binary over HTTPS from hardcoded hosts assembled by...

MAL-2026-12990 Malicious code in bnpl-blocks-mobile-bnpl-grid-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 792cb2358938b5e58ee7cd132526e95184827417dd7d66c21d6e9ae281145a70 On require of the package, index.js loads runtime.js, which assembles a rotating list of C2 hostnames from array-joined string fragments resolving to...

Malicious code in boxy-legacy-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8102d4aaa8c2a93380336ea524f83a3025cd00c71104060245f2143ba1b2694e On require of the package's main entry, index.js loads shim.js which unconditionally executes a dropper: it selects a platform-specific payload,...

MAL-2026-12552 Malicious code in checkout-create-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf66f90f0fd4a6d5d6478f1b032efc6d9eaf3c2e7d02fe60b566b02ea4a68193 Package advertises itself as a token-generation library but its main entry index.js silently side-loads platform.js via a try/catch require. On impor...

Malicious code in checkout-iframe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 934be30452a9d059a8a51c5f53461099b248d3c91217f95b9fe5fe11c7981f87 On require'checkout-iframe', index.js loads platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12572 Malicious code in checkout-mobile-bnpl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0734507ccd6f61cb81c277d9e9215c90f0b8cff1bd16f0c3eacd399750d26b4f index.js requires./helpers on load. helpers.js reconstructs three Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

MAL-2026-12714 Malicious code in devplatform-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b21acc89730541bc58390e2694a9e5410417e5232bb4f4d47c0c27b035e2f4 Package is published as an i18n library but its main entry index.js requires./setup on load. setup.js selects a per-platform payload path, fetches...

Malicious code in devplatform-spa-plugin-thermostat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe54d9f541a205ad779acf3da6216c85ec0e20b6a502aaff03dc88b7cf2d85c7 On require, index.js loads compat.js which selects a per-platform payload path, downloads a binary over HTTPS from rotating Cloudflare Workers...

Malicious code in bnpl-blocks-desktop-bnpl-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4909f4a2b9f9355cd2cbde2b75f8a5d7d3f4ec6b79ed828fdb9cc18b23107e0 On require of the package, index.js loads./setup, which selects a platform-specific URL, fetches an opaque binary from string-concatenated Cloudflare...

MAL-2026-12133 Malicious code in accounts-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f17174f805fda0f57e8b471b2a788e92836a2c20d5da22e818ed43218503b0ed On require of accounts-forms, index.js loads polyfill.js which selects a platform-specific URL and downloads an opaque binary over HTTPS from hardcod...