MAL-2026-13287 Malicious code in dolyame-boxy-atom-bnpl-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f The package's main entry loads setup.js, which on require fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are...

Malicious code in dolyame-boxy-desktop-bnpl-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626b386d1f127bc0ed973dbac051023f0f021b0be476d1cd8678802ef98c5d42 On require of the package, index.js unconditionally loads bootstrap.js, which downloads a platform-specific binary from hostnames assembled via...

Malicious code in dolyame-boxy-desktop-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee The package main index.js requires ./init on load. init.js assembles hostnames via string-split .join'' obfuscation to produce a rotating list of...

MAL-2026-13320 Malicious code in dolyame-boxy-independent-bnpl-main-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698 index.js unconditionally requires./bridge on load. bridge.js selects a per-platform payload linux x64/arm64, darwin, win32, fetches a native binary...

MAL-2026-12821 Malicious code in beaver-ui-popover-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7a6f956dc3e60442172279367aeb7cbfb758a853f844c53b3ff22a972f0bac5 On require'beaver-ui-popover-card', support.js downloads a platform-specific binary from Cloudflare Workers endpoints whose hostnames are assembled a...

Malicious code in beaver-ui-popover-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7a6f956dc3e60442172279367aeb7cbfb758a853f844c53b3ff22a972f0bac5 On require'beaver-ui-popover-card', support.js downloads a platform-specific binary from Cloudflare Workers endpoints whose hostnames are assembled a...

Malicious code in bnpl-blocks-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b74429ec0cf706ca11dded285a5b89933db6cbbf2b38905c0b0549be62a8f1 On require'bnpl-blocks-analytics', index.js loads compat.js whose top-level start function downloads an OS-specific binary from Cloudflare Workers...

MAL-2026-12861 Malicious code in bnpl-blocks-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b74429ec0cf706ca11dded285a5b89933db6cbbf2b38905c0b0549be62a8f1 On require'bnpl-blocks-analytics', index.js loads compat.js whose top-level start function downloads an OS-specific binary from Cloudflare Workers...

Malicious code in bnpl-blocks-atom-bnpl-anchor-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c841de8c355f3970534d5ec0f0c5eb63ed72a4d70f8d715c2e781c276acdb20 On require of bnpl-blocks-atom-bnpl-anchor-menu, index.js loads loader.js which assembles hostnames from split-string arrays evading static analysis,...

Malicious code in devplatform-react-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422556511a13a0424a33cfdb404a289d3fd51a0f7f206b4de8114fe69a0874b6 On require'devplatform-react-form', index.js loads adapter.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers...

MAL-2026-12735 Malicious code in devplatform-react-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422556511a13a0424a33cfdb404a289d3fd51a0f7f206b4de8114fe69a0874b6 On require'devplatform-react-form', index.js loads adapter.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers...

Malicious code in devplatform-rest-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5813e9b97274c2eb3abd3459781550762baeea8c8fc0cec09603dac56a405d8 On require'devplatform-rest-client', index.js loads init.js which selects a platform-specific endpoint, downloads a binary from one of three Cloudfla...

MAL-2026-12406 Malicious code in pfa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e06752c5f827cccdf98f23fa26d893d44e2889b8b7011e8fdb130524f09fe0f On require'pfa-errors', index.js unconditionally loads runtime.js, which fetches a platform-specific opaque binary from one of three hardcoded...

Malicious code in pfp-forms-sme-sitebuilder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f0c2b9f45c8e537bcf70d98c1aa5daa263962eae954c2d871d978e0ac0dd64 index.js unconditionally requires./support on module load. support.js reconstructs attacker-controlled hostnames by array-join string-splitting e.g...

Malicious code in pfp-forms-independent-sme-glossary-anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c96f28993eb59bb78a357534cf64aac001732fc4951ccb33f8eca2a3ce615f3c On require of the package, index.js loads compat.js which reconstructs mirror hostnames via string-splitting joins oob-worker.cf102-baf.workers.dev,...

Malicious code in twork-data-services-aggregator-sme-task-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7847fa8341bf64260b2ff25824d2dbb7b80f637d77578db5604ea7ab39ea2874 On require of this package, index.js loads runtime.js which asynchronously fetches a platform-specific binary from string-concatenation-obfuscated...

Malicious code in twork-data-services-product-design-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a86edfca41ff32a7b044ecb921977944dbdc5cf5d2a3ccae4e5ca001a851816 On require of the package's main module, loader.js downloads a platform-specific binary from a set of obfuscated Cloudflare Workers subdomains...

MAL-2026-12296 Malicious code in twork-data-services-product-design-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a86edfca41ff32a7b044ecb921977944dbdc5cf5d2a3ccae4e5ca001a851816 On require of the package's main module, loader.js downloads a platform-specific binary from a set of obfuscated Cloudflare Workers subdomains...

Malicious code in scandoc-scandoc-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88040968dbf46cb6d8018a4c21563f6845140435ce3b93e69b0934a81a8a469b On require of the package, index.js loads vendor.js which fetches a platform-specific binary from Cloudflare Workers hostnames reconstructed at runti...

Malicious code in tinkoff-statist-browser-typed-client-eventea.projects.smartcam (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edf869ab3e355848cb77fff3b129c2fe0b80e01286fe28783a0e66e064cee87e On require of the package, index.js loads loader.js which downloads a platform-specific native binary from Cloudflare workers.dev endpoints whose...