Malicious code in dolyame-boxy-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1830a31476314b9c1be462eba26a2314ed333d547a3f55bb62ff7ca44b5c9074 On require, index.js loads loader.js which selects a platform-specific payload path, fetches bytes over HTTPS from obfuscated hosts assembled via...

MAL-2026-13127 Malicious code in dolyame-boxy-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1830a31476314b9c1be462eba26a2314ed333d547a3f55bb62ff7ca44b5c9074 On require, index.js loads loader.js which selects a platform-specific payload path, fetches bytes over HTTPS from obfuscated hosts assembled via...

Malicious code in dolyame-ui-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7679dd0e86411f0df5eea8392ad6f6a663ab0d911cd674b3ef4605af846cb323 On require of dolyame-ui-breadcrumbs, index.js loads bridge.js which reconstructs C2 hostnames at runtime via string-splitting/array-join resolving t...

Malicious code in dolyame-boxy-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32273cf2b594fbdf7b09058c383c7d40319001732490771eda7931aaf01bf451 On require'dolyame-boxy-scroll', index.js loads ext.js which selects a platform-specific path linux/darwin/win32, downloads a binary from one of thre...

MAL-2026-13137 Malicious code in dolyame-ui-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d0fed433faae413825a41330dcf81ec06db856008fdf7ebb4cd3e385626b4ce On require of the package's main entry index.js, adapter.js unconditionally fetches an opaque binary payload from runtime-reconstructed Cloudflare...

MAL-2026-13135 Malicious code in dolyame-ui-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3df9ea5c492e81553a008ca4fbc71c2c4824b6278bb6a81f11d5e8dc005f561e On package load, index.js requires./platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-ui-accordion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a72f168a8501a4518ddfc5cdda24be49bfa8effefbf72fa490bbaa57daa3637 The package is advertised as a React accordion UI component but on require unconditionally loads vendor.js, which downloads a platform-specific binar...

Malicious code in ded-aa-liza-ded-aa-liza-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074f0a8014fabe8bdb281c1c07180290bcff2b10d67d723f1c7917ea198d5c5a On require of ded-aa-liza-ded-aa-liza-core, index.js loads ext.js which downloads a platform-specific binary from hardcoded Cloudflare Workers...

MAL-2026-13124 Malicious code in ded-aa-liza-ded-aa-liza-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074f0a8014fabe8bdb281c1c07180290bcff2b10d67d723f1c7917ea198d5c5a On require of ded-aa-liza-ded-aa-liza-core, index.js loads ext.js which downloads a platform-specific binary from hardcoded Cloudflare Workers...

MAL-2026-13123 Malicious code in ded-aa-common-ded-aa-common-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30a80297ae44091b682bf8fa68610f345348813d94b2c84e7f82a3183b938a94 On require of the package, index.js loads ext.js which fetches an opaque platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in dolyame-ui-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b0f03a063fb3a6b8c7605612b587eddfefa6181b85b14654ee93f267dd790e1 On require of the package, index.js loads compat.js, which at module load time downloads a platform-specific binary from hostnames assembled at runti...

MAL-2026-13144 Malicious code in dolyame-ui-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a445ffd0f222f7d58ad870ad641f9dd2fb21a1cc43795cbef5c58109cafebbe On require of the package, index.js loads vendor.js, which reconstructs a set of C2 hostnames from string-split fragments four .workers.dev mirrors a...

MAL-2026-13145 Malicious code in dolyame-ui-clickable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f92051e4b21bd0bc9562833662ba7e1e9185bc8342bcc8bbbac8fc4d848c4dbe On require of the package, index.js unconditionally loads init.js, which selects a platform-specific endpoint linuxx64, linuxarm64, darwin, win32 and...

Malicious code in dolyame-ui-draggable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81324df09668ea22833f1cff69d3e861bbb0644e5f231028ef2ea8ba0f9b8631 The package advertises itself as a UI toolkit, but its main entry requires./runtime.js, which on load downloads a platform-specific binary from...

Malicious code in dolyame-ui-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ebf602f046406a056b2d9d36768cf4592ae2f8a02375b0fdb5212c3cc1e80ca On require of dolyame-ui-footer, index.js loads./runtime.js which selects a per-OS payload path, fetches a binary via HTTPS from one of three hardcod...

MAL-2026-13155 Malicious code in dolyame-ui-flag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be48c86f2b67912c3cfa1849431e5eb3d45510c55bb1fa98ab304dc36d25097b On require of the package, index.js loads vendor.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev hosts...

Malicious code in dolyame-ui-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f21d1f60c7f97ffdc8e698c9804d9d9116f286be7a026a9c90f6e4a1858dea18 On require'dolyame-ui-grid', index.js loads polyfill.js which selects a platform-specific asset, downloads a binary from one of four hardcoded...

Malicious code in dolyame-ui-dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78e2cf3af799e05f20494aba04b5d85aa1335bce541af4cb13aa715a2cda6ea5 On require'dolyame-ui-dropdown', index.js loads helpers.js which selects a platform-specific endpoint from an obfuscated split-literal host list...

Malicious code in dolyame-ui-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15f91ac3c4278628875a5c009c515bcdb5fbc8b885eb32dff56e4367c5babf66 On require, index.js loads bootstrap.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints hostnames assembled at...

Malicious code in dolyame-ui-label (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdcede6d4d42bfed7f10577346b24e9af22655e50f8d454baab6f4999e6020f3 dolyame-ui-label 35.7.8 is not a UI component library. On require of the package, index.js loads helpers.js, which reconstructs C2 hostnames at runti...