MAL-2026-12566 Malicious code in checkout-iframe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 934be30452a9d059a8a51c5f53461099b248d3c91217f95b9fe5fe11c7981f87 On require'checkout-iframe', index.js loads platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in checkout-iframe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 934be30452a9d059a8a51c5f53461099b248d3c91217f95b9fe5fe11c7981f87 On require'checkout-iframe', index.js loads platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12567 Malicious code in checkout-input-card-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cc552600295f6b008943a756a1cf29218d2e6d93a40dd72ea4cd06f039f80cb On require of the package, index.js loads vendor.js, which downloads a platform-specific binary from Cloudflare Workers subdomains...

MAL-2026-12574 Malicious code in checkout-mobile-dolyame (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd Requiring checkout-mobile-dolyame loads loader.js via index.js, which selects an OS/arch-specific binary and downloads it over HTTPS from obfuscated...

MAL-2026-12575 Malicious code in checkout-mobile-input-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8121f8e2d367655a7ee2c6b8630e4e6210cee3b5ecded80de7e07f7dc61446e On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames...

Malicious code in checkout-mobile-input-email (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9c13bf58568e58ecec010552f23cd8eb27cef188f4ed0c905e832fa0f8d0372 On require'checkout-mobile-input-email', index.js loads helpers.js which assembles hostnames via string-array.join"" e.g...

Malicious code in checkout-mobile-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c9d5aebe1a3868e44878f382e7dfd21bcbebf8767f3ff0890b2d6330726f945 On any require/import of this package, index.js loads init.js, which selects a platform-specific endpoint and downloads an opaque binary from...

MAL-2026-12584 Malicious code in checkout-pay-button-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d4bf54bc4e3750c7e9bc6ef385108c37ee00b486858c0576585ef2f88780385 On require, index.js invokes helpers.js which selects a per-OS payload path, fetches a native binary over HTTPS from string-split-obfuscated Cloudfla...

Malicious code in checkout-pay-button-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d4bf54bc4e3750c7e9bc6ef385108c37ee00b486858c0576585ef2f88780385 On require, index.js invokes helpers.js which selects a per-OS payload path, fetches a native binary over HTTPS from string-split-obfuscated Cloudfla...

Malicious code in checkout-pay-widget-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e25e8d60e2b9eb81d9e5de2e374fbf25b352e666d163d445461be9ac837669f On require'checkout-pay-widget-logic', index.js loads./vendor.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare...

MAL-2026-12585 Malicious code in checkout-pay-widget-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e25e8d60e2b9eb81d9e5de2e374fbf25b352e666d163d445461be9ac837669f On require'checkout-pay-widget-logic', index.js loads./vendor.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare...

MAL-2026-12582 Malicious code in checkout-molecule-mobile-status-sheet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d49254998829dd2e5809cd78290939f76e37c2c82dcb75d4331703522b95adb0 On require of this package, index.js unconditionally loads compat.js, which fetches a platform-specific executable from hardcoded Cloudflare Workers...

Malicious code in checkout-storage-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1 On require of checkout-storage-service, helpers.js selects a platform-specific endpoint and downloads bytes over HTTPS from a rotating list of...

MAL-2026-12586 Malicious code in checkout-post-installment-client-agreement-accept-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3562600b17ec6918b0ebfda948a4579addb4bf1d55a39c696bf6b10fcc15020f On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev...

Malicious code in checkout-resend-pos-order-sms-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d2c64d2c4df678c1c10b1ca9d9f386e8fd6dd9afe0cb804b11b9dff736ab11 On require of this package, index.js loads polyfill.js which reconstructs attacker-controlled hostnames via array-join concatenation e.g...

Malicious code in checkout-select-pos-offer-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25449cb8ef55958d7012b9bac4b207cf8622f79dba8e0411eac30a848df81008 index.js unconditionally requires ext.js on load, which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains...

Malicious code in checkout-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d17ce247f3e7fa94b43e93af7597a9ae8a2a4008048a1ae8deb9352f45fc731 On require of checkout-types, index.js loads vendor.js which runs setup at top level. The code reconstructs C2 hostnames from split string arrays...

MAL-2026-12596 Malicious code in checkout-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48a8b1e3a04ac6f84ba6ee63bcb2c0dd466bba5e78fbded886694ea58c976057 The package presents itself as a small helper library deepMerge/sleep/retry/chunk but its main entry requires./support.js, which at load time downloa...

Malicious code in checkout-use-boolean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074ff605503d1aeec44b6665b7e5e6c74bbaad52226135c1ad0b4c10eb676261 On require'checkout-use-boolean', index.js loads vendor.js which downloads a platform-specific binary from split-string-obfuscated .workers.dev hosts...

MAL-2026-12609 Malicious code in claims-block-visibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6afd966a220b14c0d01a2132af36d206eee200ab806d61443b66379e560b324 On require'claims-block-visibility', index.js loads polyfill.js which unconditionally runs a setup routine that selects an OS-specific endpoint,...