MAL-2026-12660 Malicious code in constructor-blocks-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96701ff9ef8e8d7ed9b946a9cb3cc7efa18a6159a1729610892fb95dc6175c31 On require of constructor-blocks-common, index.js loads helpers.js which invokes a bootstrap routine at module load. The routine reconstructs...

MAL-2026-12661 Malicious code in constructor-blocks-landings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28cdac4c3410baaaa9054b53e7d5ed9260e8322d3164fc5e1670c2ac15efa98b On require of the package's main entrypoint, index.js loads setup.js which selects an OS/architecture-specific asset and downloads a binary from a...

Malicious code in delivery-ci-microforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffef831e876b8114ebfd6559d38f34d2c559dd42263845899e45ee621aa15c7 On require'delivery-ci-microforms', index.js loads support.js which selects a platform-specific endpoint whose hostname is reassembled at runtime fro...

MAL-2026-12678 Malicious code in delivery-ci-pipeline-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48367fe7933e3c07d664eda305a21bd8de43e06c685170b2146da16249bde15c index.js unconditionally requires init.js on load. init.js assembles attacker-controlled hostnames from split string fragments joined at runtime e.g...

Malicious code in delivery-ci-notify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf92bb7d56497b7cc6eb6b7b04a210fb531faa624a9c1b97e830fbf745d6258 On require of delivery-ci-notify, index.js loads shim.js which selects a platform-specific asset, downloads a native binary from one of three hardcod...

Malicious code in delivery-ci-validate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a6fb547c4fb156493439557692dc83b73f44deee6687ec535882f7e8ccf490 Requiring delivery-ci-validate loads polyfill.js, which assembles destination hostnames from split string fragments joined at runtime e.g...

Malicious code in delivery-ci-sage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b54c7175e494e683cdbc63814267aa5544f88d0373b929b9f0fe3fcb8202bd3 On require of the package, index.js loads loader.js which selects a platform-specific asset path and fetches a binary from one of four...

MAL-2026-12685 Malicious code in delivery-ci-update-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7aaa115c4d227fa01dd5a8b2e9f6945b21c65a7df4433ecf527ef69b3d0b40 On require, index.js loads adapter.js which fetches an unsigned, unhashed platform-specific executable from hardcoded Cloudflare Workers subdomains...

Malicious code in delivery-ci-update-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7aaa115c4d227fa01dd5a8b2e9f6945b21c65a7df4433ecf527ef69b3d0b40 On require, index.js loads adapter.js which fetches an unsigned, unhashed platform-specific executable from hardcoded Cloudflare Workers subdomains...

Malicious code in devplatform-api-v2-resource-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde262833260cbba75c5fdd2160e0f91a6c43c0f7ad202b44475c649772c1174 [email protected] is an import-time dropper. The package's main entry index.js requires compat.js, which on load assembles C2...

MAL-2026-12704 Malicious code in devplatform-cli-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bb41284069ba395bf67ceb847dc579c7a79c753ea89107116e91559ebbece2a On require'devplatform-cli-spa', index.js loads support.js which selects a payload by OS and architecture, downloads a native binary over HTTPS from...

Malicious code in devplatform-di (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3fd866e9abd20e9fa0c9ca40131d13b1ca98e2abbe73f53fd063581a65256d9 On require'devplatform-di', index.js loads compat.js which fetches a platform-specific executable from string-split-obfuscated hosts...

MAL-2026-12712 Malicious code in devplatform-http-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0232efebd49d07216da6eabd594c614076a3d1b414417d0d1be86d547a9c1adc On require of devplatform-http-client, index.js loads vendor.js which unconditionally invokes init. The routine selects a platform-specific payload...

MAL-2026-12725 Malicious code in devplatform-nx-pvm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58df39bb6ab40bc06f0c7db6a10753e81979cae9692633b51a33089ff6d28aa4 On require of devplatform-nx-pvm, compat.js fetches a platform-specific binary over HTTPS from hardcoded hosts oob-worker.cf100-416.workers.dev,...

Malicious code in devplatform-iam-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494d7de346ffd38cb213791a60c0a1e19d6391e79643e052d31c8ac1e8028b3f The package presents a no-op DevplatformIamClient export, but index.js unconditionally requires./init.js on load. init.js selects a platform-specific...

MAL-2026-12714 Malicious code in devplatform-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b21acc89730541bc58390e2694a9e5410417e5232bb4f4d47c0c27b035e2f4 Package is published as an i18n library but its main entry index.js requires./setup on load. setup.js selects a per-platform payload path, fetches...

MAL-2026-12719 Malicious code in devplatform-jscodeshift-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...

Malicious code in devplatform-nx-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc4017373371f50665290c944ee840b2ad4a7e745dcb5eb973f977185b150ac7 The package presents as a devkit for the Nx ecosystem but ships a trivial no-op class in index.js alongside a hidden shim.js. On require, index.js...

Malicious code in devplatform-nx-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4cd991fb1b5e2308797829d38de8ba8b673c91a889e800621d01faef34610d devplatform-nx-husky is a typosquat blending the nx and husky ecosystem terms; its exported class is an inert no-op and the package has no legitimate...

Malicious code in devplatform-humanize-network-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d18ba9f3689dbc03127a3d82ffe0a6a2a15edf3e7f58b7ca9322499b2b68197 [email protected] advertises itself as a network-error humanizing utility, but on require its index.js unconditionally loads...