MAL-2026-13200 Malicious code in dp-owners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f190519e55e1e9899983a76806e839baf855abf0a0120e83bcac5547405c09 On require of dp-owners, init.js selects a platform-specific path, downloads a binary from hardcoded Cloudflare Workers hosts assembled via...

Malicious code in statist-browser-typed-client-risktech.uwfrontantifraud.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e4bd3cdacfc8ad3f6e278f3bdfa4c19ed82be8ad966863c91c176af4f712d26 On require/import, compat.js reached from index.js downloads a platform-specific executable from hardcoded Cloudflare Workers subdomains...

MAL-2026-12191 Malicious code in scandoc-scandoc-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88040968dbf46cb6d8018a4c21563f6845140435ce3b93e69b0934a81a8a469b On require of the package, index.js loads vendor.js which fetches a platform-specific binary from Cloudflare Workers hostnames reconstructed at runti...

Malicious code in volna-boxy-di-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caad3654d755de84a91ca9afc1d7d393a1e2868b54b0b03020780b7878df28f8 On require, index.js loads compat.js which selects a platform-specific payload path, reconstructs C2 hostnames at runtime from split string fragments...