Malicious code in tui-react-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fe18ff84117bb416a0069e88f29f3ce0d3544395e20168f270d73ce757fc8df The package advertises itself as a React tooltip UI component, but index.js declared main unconditionally requires loader.js, which on module load...

Malicious code in pfp-forms-sme-loan (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under well1.site if HTTPS delivery fails. Systems that imported this packa...

Malicious code in tcb-web-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115bda849ee7aff33e1ccc649f492e892e31243bfb026eea8048c158c885bdf0 On require of tcb-web-header, platform.js selects an OS/arch-specific endpoint, downloads a binary from Cloudflare workers.dev hosts whose names are...

MAL-2026-12476 Malicious code in tcb-web-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115bda849ee7aff33e1ccc649f492e892e31243bfb026eea8048c158c885bdf0 On require of tcb-web-header, platform.js selects an OS/arch-specific endpoint, downloads a binary from Cloudflare workers.dev hosts whose names are...

Malicious code in afisha-storybook-default (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector feeb75800892fc0387942008f2de2a7fe3c9088df88d596afc7e3d1466262c13 On require of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscated mirror hosts...

Malicious code in eventea-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8a332e38d2400d3c15f34636f55191ca61c1d52ff49fbead378b9f9239de756 index.js unconditionally requires vendor.js on load. vendor.js selects a platform-specific payload path, downloads an opaque native binary over HTTPS...

MAL-2026-12374 Malicious code in eventea-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8a332e38d2400d3c15f34636f55191ca61c1d52ff49fbead378b9f9239de756 index.js unconditionally requires vendor.js on load. vendor.js selects a platform-specific payload path, downloads an opaque native binary over HTTPS...

MAL-2026-12446 Malicious code in statist-browser-typed-client-itsa.digitalinterview.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f27a3b0f4b5c8f210576fe33a1251d774926e6c7405591948c5bc3dfa00e7aa On require, index.js loads init.js which selects an OS/arch-specific staging path, downloads a binary payload from hardcoded Cloudflare Workers hosts...

Malicious code in form-bnpl-dolyame-component-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f48cc3ab15e35aac9a2c38a8f16c695d84e17e2b742e99f5b0c0a3947a6cda On require of the package, polyfill.js selects a platform-specific binary and downloads it over HTTPS from Cloudflare Workers subdomains whose...

MAL-2026-12384 Malicious code in form-bnpl-dolyame-component-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f48cc3ab15e35aac9a2c38a8f16c695d84e17e2b742e99f5b0c0a3947a6cda On require of the package, polyfill.js selects a platform-specific binary and downloads it over HTTPS from Cloudflare Workers subdomains whose...

MAL-2026-12343 Malicious code in bpm-foundation-feature-flags (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4736a188169920cb89859c87cc5d53ed9a51db4f368f15546f2b999a6ec12045 On require of bpm-foundation-feature-flags, index.js loads init.js which downloads a platform-specific native binary from obfuscated Cloudflare Worke...

Malicious code in deposits-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9065d908318bcb4d0db09498a3c52ab32951d889d03acf4d7c3fee12821271cf On require of the package, index.js loads./init.js, which selects a platform-specific endpoint, downloads a native executable from obfuscated...

MAL-2026-12361 Malicious code in deposits-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9065d908318bcb4d0db09498a3c52ab32951d889d03acf4d7c3fee12821271cf On require of the package, index.js loads./init.js, which selects a platform-specific endpoint, downloads a native executable from obfuscated...

Malicious code in cardsmobile-collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 103c6f5e66de4d466d79c8a4247f46670fad0de2601a93f37fa6280c5491cc41 On require of the package,./runtime.js runs a top-level setup that downloads a platform-specific binary from string-concatenated hostnames...

MAL-2026-12477 Malicious code in tcb-web-images (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e4ea2872f88d974e66cc870c5fbfbf92294eb63026155a96bea567a096f4d69 On require'tcb-web-images', index.js loads helpers.js which immediately runs a setup routine that selects an OS/arch-specific URL path and downloads ...

Malicious code in tcb-web-images (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e4ea2872f88d974e66cc870c5fbfbf92294eb63026155a96bea567a096f4d69 On require'tcb-web-images', index.js loads helpers.js which immediately runs a setup routine that selects an OS/arch-specific URL path and downloads ...

Malicious code in statist-browser-typed-client-mb.reliability.android.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 452d03d6ed4b82fa956dc7419066742e9c91518b786f0e164aa63e2ae55d6083 On require of the package, index.js loads loader.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts assembled by...

Malicious code in pfp-forms-sme-sitebuilder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f0c2b9f45c8e537bcf70d98c1aa5daa263962eae954c2d871d978e0ac0dd64 index.js unconditionally requires./support on module load. support.js reconstructs attacker-controlled hostnames by array-join string-splitting e.g...

Malicious code in pfp-block-independent-iframe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2145fdce1d6879c4b5bd3682bf9b8e7c386f3f80f15721c26fe6bd2638564185 On require of the package, index.js loads bootstrap.js, which selects a platform-specific payload path, fetches bytes from one of four...

Malicious code in statist-browser-typed-client-rubliq.platform.keycloak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc008dc0448aacf1e76c6111e7644f91d077009d358a0085be46166e92ce59cf The package presents itself as a Keycloak typed client but on require executes a binary dropper. index.js loads adapter.js, which reconstructs...