MAL-2026-13658 Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c602d22e5a0f1d7cee18a98a7ce0b67e2c8440f7ff95330cb6c33d169f2e629 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct the identifier 'childprocess' and destination...

MAL-2026-13559 Malicious code in dolyame-ui-collapseblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

MAL-2026-13283 Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

MAL-2026-13293 Malicious code in dolyame-boxy-atom-desktop-bnpl-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 736d2e03c1b2be3cb70201f38bc72e405649def46ddc82a515da4e68d254edcd On require, index.js loads bootstrap.js, which reconstructs remote hosts by array.join string concatenation oob-worker.cf100-416.workers.dev,...

Malicious code in dolyame-boxy-atom-desktop-bnpl-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b63e38f9a4be0ffccf426124ce23e7d5c0ddfde68cc81ad44cbfe75ef22c31c The package's index.js silently loads loader.js via a swallowed try/catch try require'./loader'; catch . loader.js assembles one of three Cloudflare...

MAL-2026-13305 Malicious code in dolyame-boxy-desktop-bnpl-hero-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 036c11daa7712014748d57bc2bca8a37672acffa8f3eaca83161b726ba473fdb On require of the package, helpers.js reassembles hostnames from split string arrays e.g. 'oob-worker.cf102-baf.workers.dev',...

MAL-2026-13302 Malicious code in dolyame-boxy-desktop-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b6f75040edc2a67f6c4912c7b8ff63ec6bd8dbd35c235bd3787ea24f52d4a2 On require/import, index.js loads./polyfill.js which selects a platform-specific endpoint, fetches bytes over HTTPS from one of several .workers.dev...

MAL-2026-13315 Malicious code in dolyame-boxy-independent-bnpl-code-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7222a6cf31e1412fd943bcf3b140b02f6c615b1650f9c39cabf813801557ae On require of the package, index.js loads ext.js which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-ui-checkable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ab13fa73d76681896cf6b34c1b61c2c417f03226865384355020bc5a4a0381c index.js unconditionally requires./setup.js on load, so any require/import of the package auto-executes a dropper. setup.js reconstructs a list of...

MAL-2026-13154 Malicious code in dolyame-ui-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 171758619b11932bfa2790206d34ea6322b3985c9cfe083915c41fdb5b18f9ed [email protected] is advertised as a UI toolkit but its main entry loads platform.js, which on require assembles destination hostnames at...

MAL-2026-13164 Malicious code in dolyame-ui-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26aae43ae2f260593e90c501c2863a515d4aa4f6753fccf82df101c62d43b77a index.js requires./loader on load. loader.js reconstructs attacker-controlled hostnames from split string fragments joined via.join"" to yield...

MAL-2026-12885 Malicious code in bnpl-blocks-atom-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d0716eec6e29280316b67f3e9a98954f501dc73a692d36b68d8106b39bd60fb On require of this package, index.js loads shim.js which assembles obfuscated non-publisher URLs by joining split string fragments resolving to a...

Malicious code in bnpl-blocks-desktop-bnpl-article-author (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f80a4ff82e37de309fbc903891bd8ac770f0542251e9b4afc15fbd36e94ac21c On require, index.js loads shim.js, which fetches a platform-specific native executable from hardcoded hosts reconstructed at runtime via array .join...

MAL-2026-12826 Malicious code in beaver-ui-storybook-addon-code-description (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8105d085fbf1a6ec1018ac850555ec02e022725ce198f54ac291133b847d9db On require of the package main, loader.js selects an OS-specific endpoint, downloads a binary via https.get from one of several hardcoded Cloudflare...

Malicious code in bnpl-blocks-independent-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7749e7f4c01551d7ec3463d1b65e3f564a9ec64cbc4801586a72652ab55e4e34 On require of the package main, runtime.js selects a per-OS endpoint, fetches an opaque executable from obfuscated Cloudflare Workers hosts hostnames...

Malicious code in bnpl-blocks-independent-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eabf8fd96af80f1588f7073731f3f670133e10f4c0e553c499081d3cb76b69ca The package advertises itself as a UI slider component but ships shim.js, which is loaded via index.js on require. On load, shim.js fetches a...

Malicious code in bnpl-blocks-independent-bnpl-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dab4ebaf15b60e320da6dd04630765fd36dc2c3a012360127653174a350e8c88 index.js requires bootstrap.js on module load. bootstrap.js reassembles obfuscated hostnames via array-join e.g. oob-worker.cf102-baf.workers.dev,...

Malicious code in bnpl-blocks-mobile-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c54195f215860087ea60839eed874351de1bf279c7a80d12c128214d3602b26 On require of the package, index.js loads./vendor.js, which assembles Cloudflare Workers hostnames from split string fragments...

MAL-2026-13033 Malicious code in boxy-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de3d566208b48f775ec51e3308934813973ad0a6fef6cb98fd438042056bb9b0 On require of the package, index.js loads shim.js which reconstructs attacker-controlled hostnames from split-string arrays Cloudflare Workers...