Malicious code in dolyame-boxy-independent-bnpl-product-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 838978067dbfc6b266e91ac3f0255687d3b31364dfac82c9f992ded8ecd1ef36 On require of index.js, runtime.js selects a platform-specific payload path, rotates through hardcoded Cloudflare Workers hosts...

Malicious code in boxy-mm-server-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26c25489d15bfaaf8e337af2f2fa446e86fdc8cc5fae3199be2451bdb35196ef On require'boxy-mm-server-loader', index.js loads polyfill.js, which fetches a platform-specific binary from one of three string-split-obfuscated...

MAL-2026-12536 Malicious code in cardsmobile-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d80bf756b4d7e7f6e27afd68a796dc43ca50d28e692d11b4af141b0af5235b On require, index.js loads shim.js which selects a platform-specific payload URL from a string-split-obfuscated list of Cloudflare Workers subdomains...