Malicious code in sme-rko-finance-front-operations-notifications-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1d9ca70f719a1aa76a11ce147945ee7acefdb72bcbf955d1c7cd30a5d9f85e8 On require of the package, index.js side-effect loads polyfill.js and lib/telemetry.js, both of which act as native-binary droppers. Hostnames and...

MAL-2026-13569 Malicious code in dolyame-ui-flatcorners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ae65f4eadd80905a644647c6f15aee082d428bf5812632a29015eccc924bf1b On require/import of the package, both adapter.js and the advertised main module lib/telemetry.js download an OS-specific binary from obfuscated...

Malicious code in bigops-insite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbe91d01b6f87752714ea87b8c79ecdda9497faf4a99709118330640cfaf46a2 On require'bigops-insite', index.js top-level loads./setup.js, which downloads a platform-specific binary from hardcoded Cloudflare Workers subdomain...

MAL-2026-13287 Malicious code in dolyame-boxy-atom-bnpl-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f The package's main entry loads setup.js, which on require fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are...

Malicious code in dolyame-boxy-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd3ad7593e26ae49876e0310a51ac122ddcb6878eefddc74a5828cce061d200b On require of the package, index.js loads init.js which assembles obfuscated Cloudflare Workers hostnames oob-worker.cf.workers.dev from string-split...

Malicious code in dolyame-ui-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7679dd0e86411f0df5eea8392ad6f6a663ab0d911cd674b3ef4605af846cb323 On require of dolyame-ui-breadcrumbs, index.js loads bridge.js which reconstructs C2 hostnames at runtime via string-splitting/array-join resolving t...

Malicious code in dolyame-ui-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b0f03a063fb3a6b8c7605612b587eddfefa6181b85b14654ee93f267dd790e1 On require of the package, index.js loads compat.js, which at module load time downloads a platform-specific binary from hostnames assembled at runti...

Malicious code in bnpl-blocks-atom-bnpl-store-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 953b66d4203e461d482f00a2011c4d79b4fd30ab0749ca3e9946837d20e48504 The package's main index.js requires ./loader at module load, causing loader.js to download a platform-specific native executable from hardcoded...

Malicious code in bnpl-blocks-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a02f6576518bfc325248a8787aff66ebad12acc3e63b05fd7b35f96ffd1a62d6 The package's index.js requires runtime.js on load, which fetches a platform-specific native binary from one of three Cloudflare Workers hosts...

MAL-2026-13049 Malicious code in boxy-get-retry-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bd36db17d5636ee0cd74be0ca5d35fc190e75749360c297ecd52821d74ab8b8 On require, index.js delegates to helpers.js which selects a platform-specific asset path, downloads an opaque binary over HTTPS from obfuscated...

Malicious code in bpm-foundation-bundle-optimization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfdca3178e2278bbc76607ff9bf6ee6a3b0d2d60db7281a231288f442a1fb616 Requiring this package triggers vendor.js, which reconstructs Cloudflare Workers hostnames oob-worker.cf10.workers.dev and DNS-fallback domains...

MAL-2026-12515 Malicious code in bpm-foundation-test-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de196f443359e53af966cb2ca288d90e59e708c2cf7ad33ab2e0e20b7df2869e On require, index.js loads setup.js which assembles destination hostnames at runtime from split string fragments resolving to...

Malicious code in cards-forms-cards-core-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d987094f38a49c0bb9ae5329e3ff47d97489ee5af348ebc7e056e752cffc1fb On require, index.js loads runtime.js which detects OS and CPU architecture, reconstructs C2 hostnames from split string fragments...

MAL-2026-12552 Malicious code in checkout-create-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf66f90f0fd4a6d5d6478f1b032efc6d9eaf3c2e7d02fe60b566b02ea4a68193 Package advertises itself as a token-generation library but its main entry index.js silently side-loads platform.js via a try/catch require. On impor...

MAL-2026-12555 Malicious code in checkout-desktop-cashback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04ab0105316a6f7d59b244610cd7a5c702e2157987ca7b91674cd34d032acf70 On require'checkout-desktop-cashback', index.js loads vendor.js which fetches a platform-specific binary from obfuscated Cloudflare Workers endpoints...

MAL-2026-12575 Malicious code in checkout-mobile-input-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8121f8e2d367655a7ee2c6b8630e4e6210cee3b5ecded80de7e07f7dc61446e On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames...

Malicious code in constructor-blocks-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96701ff9ef8e8d7ed9b946a9cb3cc7efa18a6159a1729610892fb95dc6175c31 On require of constructor-blocks-common, index.js loads helpers.js which invokes a bootstrap routine at module load. The routine reconstructs...

Malicious code in delivery-ci-validate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a6fb547c4fb156493439557692dc83b73f44deee6687ec535882f7e8ccf490 Requiring delivery-ci-validate loads polyfill.js, which assembles destination hostnames from split string fragments joined at runtime e.g...

MAL-2026-12712 Malicious code in devplatform-http-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0232efebd49d07216da6eabd594c614076a3d1b414417d0d1be86d547a9c1adc On require of devplatform-http-client, index.js loads vendor.js which unconditionally invokes init. The routine selects a platform-specific payload...

Malicious code in devplatform-iam-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494d7de346ffd38cb213791a60c0a1e19d6391e79643e052d31c8ac1e8028b3f The package presents a no-op DevplatformIamClient export, but index.js unconditionally requires./init.js on load. init.js selects a platform-specific...