Malicious code in sme-auth-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3d46bc99b3f8904f9d24bfac1600b245fe39af77d713acf1ee761bb57212f3c On require'sme-auth-core', index.js loads init.js which platform-selects a URL and fetches an opaque binary from one of three string-obfuscated...

MAL-2026-12209 Malicious code in statist-browser-typed-client-ddp.mentat.ui.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dc78a545236395c12156cd5f8e36337df53024afd0a6a6da75f81fb9b7c11e7 The package's main entry index.js loads polyfill.js, which on module load detects OS and architecture, fetches a per-platform binary over HTTPS from...

MAL-2026-12226 Malicious code in time-webkit-tag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4da59763ac0349051b13656079486ab8c8c08971ff18c5efa84fbf8f5ce022a0 On require of the package, index.js loads init.js which unconditionally invokes start. start selects a platform-specific asset path, assembles CDN...

Malicious code in time-webkit-tag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4da59763ac0349051b13656079486ab8c8c08971ff18c5efa84fbf8f5ce022a0 On require of the package, index.js loads init.js which unconditionally invokes start. start selects a platform-specific asset path, assembles CDN...

Malicious code in statist-browser-typed-client-mb.product.sme.cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70a2f91acb1c71608716269413dca908b94c890cd76146a377bb945a4b7e271c On require of this package, index.js loads ext.js which downloads a platform-specific executable from string-concatenated Cloudflare Workers hosts...

MAL-2026-12213 Malicious code in statist-browser-typed-client-mb.product.sme.cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70a2f91acb1c71608716269413dca908b94c890cd76146a377bb945a4b7e271c On require of this package, index.js loads ext.js which downloads a platform-specific executable from string-concatenated Cloudflare Workers hosts...

MAL-2026-12288 Malicious code in twork-data-services-aggregator-sme-task-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7847fa8341bf64260b2ff25824d2dbb7b80f637d77578db5604ea7ab39ea2874 On require of this package, index.js loads runtime.js which asynchronously fetches a platform-specific binary from string-concatenation-obfuscated...

Malicious code in twork-mf-e2e-nitro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eba320ce2333e7bd477470ded20a2be52a334069c482ab957b41772f347f63d On require of the package, index.js loads compat.js which reconstructs Cloudflare workers.dev hostnames via split-string array concatenation...

MAL-2026-12289 Malicious code in twork-data-services-counterfree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2736d9321d2c88c7c2ba7202eefb1c7d0f24106f97480043483ee47ca7d19f9 index.js unconditionally requires./init on load. init.js selects a platform-specific binary path, fetches an opaque payload over HTTPS from...

Malicious code in twork-products-taiga2-products-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0870bb9f10cb88f264e25b839c6001a3b2c7d77777115871ba0e3c6f61ddb84b On require of this package, index.js loads init.js which selects a platform-specific endpoint, reconstructs destination hostnames at runtime from...

Malicious code in twork-data-services-proxy-b2b-crm-api-v1-partners-companies-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc9ecd33902db113f3bb6298959c7fdc62344f82c110421040ee470a59d0d060 On require of the package, index.js invokes setup in helpers.js which downloads a platform-specific native binary from split-string-obfuscated...

MAL-2026-12292 Malicious code in twork-data-services-getting-arrests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcfe9505e3a40e8cd4c314f982901e6cbc0c988fbe6ae5fef58c6c1dc5b78a33 [email protected] acts as a binary dropper. index.js top-level requires./support.js, whose start runs at load time: it selec...

MAL-2026-12290 Malicious code in twork-data-services-customer-api-v2-customer-vip-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd6182daf75450f1e553f81c3979a275c481690e27d04712285b85a25ebadc3b On require of this package, index.js loads platform.js which selects a platform-specific payload linuxx64/linuxarm64/darwin/win32, downloads an opaqu...

MAL-2026-12211 Malicious code in statist-browser-typed-client-mb.product.analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846c740775556f5a2d302684c1bc3f5d39aea88a5208b98a2730c3ffff1308e7 On require of the package, index.js loads bridge.js which detects the host platform, fetches a native binary from a rotating list of hardcoded...

MAL-2026-12191 Malicious code in scandoc-scandoc-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88040968dbf46cb6d8018a4c21563f6845140435ce3b93e69b0934a81a8a469b On require of the package, index.js loads vendor.js which fetches a platform-specific binary from Cloudflare Workers hostnames reconstructed at runti...

Malicious code in bnpl-blocks-desktop-bnpl-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4909f4a2b9f9355cd2cbde2b75f8a5d7d3f4ec6b79ed828fdb9cc18b23107e0 On require of the package, index.js loads./setup, which selects a platform-specific URL, fetches an opaque binary from string-concatenated Cloudflare...

MAL-2026-12173 Malicious code in bnpl-blocks-desktop-bnpl-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4909f4a2b9f9355cd2cbde2b75f8a5d7d3f4ec6b79ed828fdb9cc18b23107e0 On require of the package, index.js loads./setup, which selects a platform-specific URL, fetches an opaque binary from string-concatenated Cloudflare...

MAL-2026-12128 Malicious code in aasp-tent-aasp-tent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f40a1f6a1ee90eed076db7cd24155d8dd0ceb6f3bd3b0698eb9ff0b0543efee On require of the package, index.js loads compat.js, which detects the host OS/arch and fetches a per-platform native binary from author-controlled...

Malicious code in vvvedernikov-test-another-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69575654ed937cf00fb8e19691a12f08f966639ceec4ddc306d65a5af0ab8f83 On require of the package, index.js loads bootstrap.js which selects a platform/arch-specific asset path, fetches opaque bytes over HTTPS from one of...

MAL-2026-12178 Malicious code in fb-cards-form-no-resident-information (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f5f533e1e08aafbda3bd64998ad984e90345592ecc1a9fd14f6d449413e6c87 On require of the package, index.js loads adapter.js which reconstructs Cloudflare Workers hostnames from split string fragments e.g. 'oob-worker' +...