MAL-2026-12976 Malicious code in bnpl-blocks-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 161162281afaf68fd193e2521beaf60d32c850e29cc276192497eee09646a55a On require'bnpl-blocks-markdown', index.js loads bootstrap.js which downloads a platform-specific binary from runtime-assembled Cloudflare Workers...

Malicious code in bnpl-blocks-independent-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac08a6b45c3e5bf1e25af236946e35b0329112aa715242ba326ee5b1c5f7621d On require of this package, index.js loads platform.js which downloads a platform-specific binary from one of four Cloudflare Workers subdomains whos...

Malicious code in bnpl-blocks-mobile-bnpl-category-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3b498a386a4aeab43aedc022880d8bf90e2d8feb2cc94bafe313fa73c09b4b1 On any require of this package, index.js loads loader.js, which reconstructs destination hostnames at runtime from array-join fragments...

MAL-2026-12991 Malicious code in bnpl-blocks-mobile-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f511a9eac93e0ef06eeec5ab7ec22330cb092c4fda952ec540f4a9be3fc522f On require of the package, index.js loads bridge.js which fetches an OS-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12990 Malicious code in bnpl-blocks-mobile-bnpl-grid-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 792cb2358938b5e58ee7cd132526e95184827417dd7d66c21d6e9ae281145a70 On require of the package, index.js loads runtime.js, which assembles a rotating list of C2 hostnames from array-joined string fragments resolving to...

Malicious code in bnpl-blocks-mobile-bnpl-tab-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34cc219a990162733e49aafc255a8abe4c4acd3fc56bce77ae31800fd4791678 On require of the package, index.js side-loads adapter.js which selects a platform-specific asset, downloads bytes over HTTPS from hostnames...

Malicious code in bnpl-blocks-stories-of-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2d298c1c7467e50e22e0822fb5a348773e76a2b06ab9028997578c3f1c86121 On require of this package, index.js loads bootstrap.js which downloads a platform-specific executable over HTTPS from a rotating list of...

Malicious code in bnpl-blocks-stories (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04845144f2e54662acd3413698e57b4efbbe44c47ddeb3c40c2fcc7383ae572c On require of the package, index.js loads./ext which reconstructs hardcoded hostnames via fragment-joined arrays e.g. oob-worker.cf99-9b3.workers.dev...

MAL-2026-13018 Malicious code in bnpl-blocks-stories (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04845144f2e54662acd3413698e57b4efbbe44c47ddeb3c40c2fcc7383ae572c On require of the package, index.js loads./ext which reconstructs hardcoded hostnames via fragment-joined arrays e.g. oob-worker.cf99-9b3.workers.dev...

Malicious code in bnpl-blocks-types-gen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de78304bd1becbc9d7c967d281a308b18da039554be722990596f528180454f5 On require'bnpl-blocks-types-gen', top-level code in index.js invokes setup in platform.js, which selects a platform-specific binary path, downloads...

Malicious code in boxy-cook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 838730a7f01e8f6ae8a0c6b51b78d64ed8fd488364b6004826b4051e75416388 On require of the package, index.js loads polyfill.js which fetches a platform-specific native binary and executes it. Destination hostnames are...

MAL-2026-13048 Malicious code in boxy-fixture-sb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 569ec5c3f70be02f417bbbe5694a31d6c7d48dadfcacc2500455fffb5ff23d07 On require of boxy-fixture-sb, index.js loads compat.js which reconstructs Cloudflare Workers hostnames from string-split arrays joined at runtime to...

Malicious code in boxy-debugger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6ac284218d923021a85994af157c45906518ab6651f7a164641f02a5bc4db2 boxy-debugger 35.3.4 presents itself as a debugger library, but requiring the package triggers platform.js, which reconstructs attacker-controlled...

MAL-2026-13061 Malicious code in boxy-maker-page-readiness (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 273f130823f6759922a2e1d6f7c58ba24b9df17f7c08c6f6e43b0818b5aad4ed index.js unconditionally requires bootstrap.js on module load. bootstrap.js reassembles hostnames from split-string arrays e.g...

Malicious code in boxy-maker-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa86d66c8cd9a63a566e94925453ec6b5d144da1adff066c7cf861ae0a02be5b On require of the package, runtime.js runs a bootstrap routine that downloads a platform-specific binary from obfuscated Cloudflare Workers subdomain...

MAL-2026-13060 Malicious code in boxy-maker-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa86d66c8cd9a63a566e94925453ec6b5d144da1adff066c7cf861ae0a02be5b On require of the package, runtime.js runs a bootstrap routine that downloads a platform-specific binary from obfuscated Cloudflare Workers subdomain...

Malicious code in boxy-mm-server-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26c25489d15bfaaf8e337af2f2fa446e86fdc8cc5fae3199be2451bdb35196ef On require'boxy-mm-server-loader', index.js loads polyfill.js, which fetches a platform-specific binary from one of three string-split-obfuscated...

MAL-2026-13078 Malicious code in boxy-rspack-optimize-sharing-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4136f667c5959249d83cd2f0a7322d10c005450c7ce18ae1c1723e0a017e80 The package's index.js unconditionally requires./bridge on module load. bridge.js selects a platform-specific payload path linuxx64, linuxarm64,...

MAL-2026-13099 Malicious code in boxy-wrapper-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 835a7dd72392b1156dbab57a57b627982e490b3dbd2a4f772dea0b112b8c8a50 The package's main entrypoint index.js unconditionally requires./compat.js, whose top-level main reconstructs obfuscated Cloudflare Workers hosts...

MAL-2026-13119 Malicious code in bpm-foundation-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1e2729c7a957ee4366b693a24d178137743df7bf2ee5d65d3cecf3c8cfdc5f On require, index.js loads ext.js, which selects a platform-specific path, fetches an executable over HTTPS from string-concatenation-obfuscated host...