2264 matches found
Malicious code in dolyame-boxy-desktop-bnpl-footer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bdd69d6a0625e30b3c7764f12685db79bacb5c01e092772a38bbd7019addf54 Requiring dolyame-boxy-desktop-bnpl-footer causes platform.js to execute at load time: it reconstructs destination hostnames from split string arrays...
Malicious code in dolyame-boxy-desktop-bnpl-title (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee The package main index.js requires ./init on load. init.js assembles hostnames via string-split .join'' obfuscation to produce a rotating list of...
MAL-2026-13314 Malicious code in dolyame-boxy-independent-bnpl-cards (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts...
Malicious code in dolyame-boxy-independent-bnpl-cards (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts...
Malicious code in dolyame-boxy-independent-bnpl-preset-container (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84696fc788619027dfd5efa2c8a27158b9afb95af39201163586f7fc5f27bd1a index.js requires platform.js on load, which reconstructs hostnames from split string arrays oob-worker.cf10-.workers.dev and sdk.dl.wel1.ru to hide...
MAL-2026-13315 Malicious code in dolyame-boxy-independent-bnpl-code-text (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7222a6cf31e1412fd943bcf3b140b02f6c615b1650f9c39cabf813801557ae On require of the package, index.js loads ext.js which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers hosts...
Malicious code in dolyame-boxy-independent-bnpl-code-text (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7222a6cf31e1412fd943bcf3b140b02f6c615b1650f9c39cabf813801557ae On require of the package, index.js loads ext.js which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers hosts...
MAL-2026-13318 Malicious code in dolyame-boxy-independent-bnpl-info-slider (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681 On require of the package, index.js loads vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of...
MAL-2026-13325 Malicious code in dolyame-boxy-independent-bnpl-picture-gallery (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c2f5f635baa82fb1cc166956476dc3d7560c0c5d9e49a29aa4123256fdd9310 On require of the package, index.js unconditionally loads bootstrap.js, which selects a platform-specific endpoint and downloads an opaque binary fro...
MAL-2026-13324 Malicious code in dolyame-boxy-independent-bnpl-partners (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation...
Malicious code in dolyame-boxy-independent-bnpl-partners (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation...
MAL-2026-13320 Malicious code in dolyame-boxy-independent-bnpl-main-banner (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698 index.js unconditionally requires./bridge on load. bridge.js selects a per-platform payload linux x64/arm64, darwin, win32, fetches a native binary...
MAL-2026-13272 Malicious code in devplatform-vite-plugin-external (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a591855b5f44a53d20e6258728aeb5c0254fb10dac285f579fffcfc97608061 The package's main entry index.js unconditionally requires./setup on load. setup.js selects an OS/arch-specific endpoint and downloads a binary from ...
Malicious code in devplatform-vite-plugin-external (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a591855b5f44a53d20e6258728aeb5c0254fb10dac285f579fffcfc97608061 The package's main entry index.js unconditionally requires./setup on load. setup.js selects an OS/arch-specific endpoint and downloads a binary from ...
MAL-2026-12821 Malicious code in beaver-ui-popover-card (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7a6f956dc3e60442172279367aeb7cbfb758a853f844c53b3ff22a972f0bac5 On require'beaver-ui-popover-card', support.js downloads a platform-specific binary from Cloudflare Workers endpoints whose hostnames are assembled a...
Malicious code in beaver-ui-popover-card (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7a6f956dc3e60442172279367aeb7cbfb758a853f844c53b3ff22a972f0bac5 On require'beaver-ui-popover-card', support.js downloads a platform-specific binary from Cloudflare Workers endpoints whose hostnames are assembled a...
Malicious code in beaver-ui-multi-select-with-all (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbb4bab7b1c75e94cd3411aa312a1313e3d5a84bed77943b10f8c969b751cb23 On require of the package's main entry, index.js loads loader.js which selects a per-platform URL, downloads an opaque native binary from one of thre...
MAL-2026-12818 Malicious code in beaver-ui-multi-select-with-all (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbb4bab7b1c75e94cd3411aa312a1313e3d5a84bed77943b10f8c969b751cb23 On require of the package's main entry, index.js loads loader.js which selects a per-platform URL, downloads an opaque native binary from one of thre...
Malicious code in beaver-ui-subheader (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b62336df8b8ee0e1bd3939f4515a4b25dd6741773f30344cd3a0d065d16358fb The package advertises itself as a UI subheader component, but index.js requires./support on load and support.js downloads a platform-specific binary...
MAL-2026-12827 Malicious code in beaver-ui-subheader (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b62336df8b8ee0e1bd3939f4515a4b25dd6741773f30344cd3a0d065d16358fb The package advertises itself as a UI subheader component, but index.js requires./support on load and support.js downloads a platform-specific binary...