Malicious code in cardsmobile-event-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66db77fd91ad9316ea06a13f10281595e60cf846e89787bcbb793d061cdd1315 On require of cardsmobile-event-emitter, index.js unconditionally loads loader.js, which fetches an opaque platform-specific binary over HTTPS from...

MAL-2026-12532 Malicious code in cardsmobile-event-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66db77fd91ad9316ea06a13f10281595e60cf846e89787bcbb793d061cdd1315 On require of cardsmobile-event-emitter, index.js unconditionally loads loader.js, which fetches an opaque platform-specific binary over HTTPS from...

Malicious code in cardsmobile-notifications (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a75c5659b227cbea7e622e9c5613594e590fae0580db08420e9f2493b2fd3d2 On require of cardsmobile-notifications, index.js loads support.js which fetches an OS/arch-specific executable from a rotating list of obfuscated...

MAL-2026-12530 Malicious code in cardsmobile-command-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36cfe57bdba8edd36f9303058545ce1097dd496f1c32304f1d8d912ccf321480 On require, index.js loads bridge.js which selects a platform-specific URL, downloads a binary over HTTPS from author-controlled Cloudflare Workers...

Malicious code in checkout-create-draft-agreement-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d5b346e136a72594ca30d1e1d508bb152b82d20d8beb1d14bf126dd78b9977 On require of checkout-create-draft-agreement-am, index.js loads polyfill.js which downloads a platform-specific native binary from Cloudflare Worker...

MAL-2026-12551 Malicious code in checkout-create-draft-agreement-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d5b346e136a72594ca30d1e1d508bb152b82d20d8beb1d14bf126dd78b9977 On require of checkout-create-draft-agreement-am, index.js loads polyfill.js which downloads a platform-specific native binary from Cloudflare Worker...

MAL-2026-12546 Malicious code in checkout-cashback-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3 [email protected] silently requires bootstrap.js when the package is loaded. The bootstrap script assembles Cloudflare Workers subdomain...

MAL-2026-12542 Malicious code in checkout-accounts-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b3edb78076f5105de32feda80276d41059215378d6ab90f2d11a332685c6a On require, the package loads adapter.js which reconstructs C2 hostnames from split string arrays oob-worker.cf99-9b3.workers.dev,...

Malicious code in checkout-accounts-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a On require'checkout-accounts-holder', index.js loads platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames...

MAL-2026-12541 Malicious code in checkout-accounts-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a On require'checkout-accounts-holder', index.js loads platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames...

MAL-2026-12552 Malicious code in checkout-create-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf66f90f0fd4a6d5d6478f1b032efc6d9eaf3c2e7d02fe60b566b02ea4a68193 Package advertises itself as a token-generation library but its main entry index.js silently side-loads platform.js via a try/catch require. On impor...

MAL-2026-12555 Malicious code in checkout-desktop-cashback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04ab0105316a6f7d59b244610cd7a5c702e2157987ca7b91674cd34d032acf70 On require'checkout-desktop-cashback', index.js loads vendor.js which fetches a platform-specific binary from obfuscated Cloudflare Workers endpoints...

Malicious code in checkout-desktop-cashback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04ab0105316a6f7d59b244610cd7a5c702e2157987ca7b91674cd34d032acf70 On require'checkout-desktop-cashback', index.js loads vendor.js which fetches a platform-specific binary from obfuscated Cloudflare Workers endpoints...

MAL-2026-12547 Malicious code in checkout-checkout-test-block-aff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae29db4ecd6fc6c7250d5b388eb957c9b0d1ec2b8a8966928c3da7c31aa4bf87 On require of the main entry, index.js loads loader.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hosts...

MAL-2026-12548 Malicious code in checkout-commit-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...

Malicious code in checkout-desktop-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0 On require of checkout-desktop-legal, index.js loads compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare...

Malicious code in checkout-get-installment-client-agreement-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c89ae5bb381502715feea1642012fc1c9b388a46746b357a6d8f1348e876c9 On require of the package, init.js detects the host OS and architecture, assembles Cloudflare Workers hostnames from split string fragments e.g...

Malicious code in checkout-desktop-pay-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67636a6aeed1ed70d1bfd731fb8a845f67279b3afa82aa45b8e7a8ac9fe41cee On require of this package, index.js loads bootstrap.js which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains...

MAL-2026-12570 Malicious code in checkout-mobile-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e767e42a2a85ea01a996ada873c5ddcea0c13a56a33e44255694786dfe7b8f2 On require, the package loads platform.js which selects a per-OS asset path and downloads an executable payload from hostnames reconstructed at runti...

MAL-2026-12560 Malicious code in checkout-desktop-promocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19310e46ffcb5a99a81bab29f7260407b9fb6af5af72bdd8f3b9f7819cc6ffda On require of checkout-desktop-promocode, index.js loads vendor.js which selects a per-platform endpoint, downloads a binary over HTTPS from obfuscat...