Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

MAL-2026-12742 Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

Malicious code in devplatform-react-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422556511a13a0424a33cfdb404a289d3fd51a0f7f206b4de8114fe69a0874b6 On require'devplatform-react-form', index.js loads adapter.js which fetches a platform-specific native binary from hardcoded Cloudflare Workers...

MAL-2026-12751 Malicious code in devplatform-select-fields (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25bec256fbaf68018dbca1fad82b3616a04cf8d932b67e30b5164ee74dfc4882 [email protected] executes a binary dropper on any require of the package. index.js loads shim.js, which reconstructs C2 hostnames fro...

Malicious code in devplatform-spa-plugin-cobrowsing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96860be3701b6237d300a1c6e6bc23ff724f14557543451e221b255aff08a29e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

MAL-2026-12784 Malicious code in devplatform-spa-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d43b8f8982db0f563db0d728dbc9ecdd9907e29dd45f2d9bf42e0c8416fc80fa On require'devplatform-spa-testing', index.js loads platform.js which selects a platform-specific endpoint, retrieves a payload over HTTPS from...

Malicious code in node-cache-multithread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09be7b43b4fe5e0c786fb116e4a99518c46825e2b18b5e65eca88c51470b07a0 index.js, the package's declared main entry, is a 23KB obfuscator.io RC4/base64 string-array bundle whose top-level IIFE runs on require. It requires...

MAL-2026-12409 Malicious code in pfp-block-mobile-past-meetup-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf58f1cbe01e2a0634ec464f040fc08dadf2df035af8c8a68d1fea1d51f10a85 On require of pfp-block-mobile-past-meetup-list, index.js loads ext.js which runs a bootstrap routine. It fetches a platform-specific binary via...

MAL-2026-12406 Malicious code in pfa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e06752c5f827cccdf98f23fa26d893d44e2889b8b7011e8fdb130524f09fe0f On require'pfa-errors', index.js unconditionally loads runtime.js, which fetches a platform-specific opaque binary from one of three hardcoded...

MAL-2026-12489 Malicious code in tui-react-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fe18ff84117bb416a0069e88f29f3ce0d3544395e20168f270d73ce757fc8df The package advertises itself as a React tooltip UI component, but index.js declared main unconditionally requires loader.js, which on module load...

Malicious code in tui-react-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fe18ff84117bb416a0069e88f29f3ce0d3544395e20168f270d73ce757fc8df The package advertises itself as a React tooltip UI component, but index.js declared main unconditionally requires loader.js, which on module load...

Malicious code in sme-foundation-frame-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e9bb324a555c0f087f5366e156489724c0b1e06f8b1cdb08032046a0cc1f94d On require/import of the package, index.js unconditionally loads runtime.js, which downloads a platform-specific binary from hardcoded Cloudflare...

MAL-2026-12366 Malicious code in dolyame-boxy-independent-bnpl-open-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b38c4f57c90f57ca8c3a54ebf790e726dcbba0be7a662f3ae2aa706c5521d5b On require of the package, index.js loads helpers.js which immediately invokes start. start selects a Windows, Linux, or macOS payload path, download...

Malicious code in evo-web-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01a5ea39e9c916ea6155783b98eeb71551a8a7966edad05852816786e902ac92 On require, index.js auto-loads support.js which reassembles download hosts at runtime from string fragments e.g. Cloudflare Workers subdomains under...

Malicious code in deposits-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9065d908318bcb4d0db09498a3c52ab32951d889d03acf4d7c3fee12821271cf On require of the package, index.js loads./init.js, which selects a platform-specific endpoint, downloads a native executable from obfuscated...

Malicious code in fb-hr-sites--boxified-form-meetup-subcribe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8aa49d4f3babc81510150e766a38674e971d7553cb05d98b67d0edd24a2fa07 The package's index.js exports an inert class and silently requires./platform inside a swallowed try/catch. On load, platform.js downloads a...

Malicious code in cardsmobile-collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 103c6f5e66de4d466d79c8a4247f46670fad0de2601a93f37fa6280c5491cc41 On require of the package,./runtime.js runs a top-level setup that downloads a platform-specific binary from string-concatenated hostnames...

MAL-2026-12346 Malicious code in cardsmobile-collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 103c6f5e66de4d466d79c8a4247f46670fad0de2601a93f37fa6280c5491cc41 On require of the package,./runtime.js runs a top-level setup that downloads a platform-specific binary from string-concatenated hostnames...

Malicious code in code-analyzer-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41c70b60414be4e045ae4c1eff1ab33b674c78cc9e2eadadfbdca6317de3a251 index.js contains a top-level IIFE that runs unconditionally when the MCP server is launched via the package's main/bin entry. The IIFE spawns calc.e...

Malicious code in tms-x-headers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d2d5c1a35629a169457029c69505622c3f6a7b6bdc8958480aea47ffe08266b On require of the package, helpers.js fetches a platform-specific binary from hostnames assembled by concatenating string fragments...