Malicious code in tinkoff-volna-zustate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01865b8f060a3e4a24f34537d14ace960460519b2e5e3073083c7de9da63bd9e On require'tinkoff-volna-zustate', index.js loads bridge.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12255 Malicious code in tinkoff-statist-browser-typed-client-cardsmobile.events.promotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4185505bd2dc58df4422a0293f5dff2db30a75a0002171bff425c85de1923bbb On require of the package, index.js loads polyfill.js, which selects a per-OS/arch asset path and downloads a binary from one of three hardcoded...

Malicious code in tinkoff-statist-browser-typed-client-dss.insurance.service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06e47fdfb2c7084e3434ab12deeb9c7d75188cd7517b0f00dc90907065d2ecab On require of the package, index.js loads runtime.js which fetches a platform-specific binary from anonymous Cloudflare Workers endpoints...

MAL-2026-12257 Malicious code in tinkoff-statist-browser-typed-client-dss.insurance.service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06e47fdfb2c7084e3434ab12deeb9c7d75188cd7517b0f00dc90907065d2ecab On require of the package, index.js loads runtime.js which fetches a platform-specific binary from anonymous Cloudflare Workers endpoints...

MAL-2026-12146 Malicious code in beaver-ui-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86ba5710d957735b0f3fde73e6b6ba99347296b8dc992db5f1807924f3ffc139 The package's declared main index.js unconditionally loads ext.js, which on require fetches a platform-specific binary from obfuscated Cloudflare...

Malicious code in beaver-ui-form-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b91edd276d95174766d639bab6981de8e07b4261e57668fc61f8e7dd96cc1e On require of the package, index.js loads polyfill.js whose top-level bootstrap fetches an opaque platform-specific binary over HTTPS from...

Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

MAL-2026-12148 Malicious code in bigops-api-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acd531683a48496b0b96d04fb0264b4e49f46d43a099af7172bd259c20bf7bcc On require of the package, index.js loads runtime.js which selects a platform-specific endpoint from a list of Cloudflare Workers subdomains...

Malicious code in tinkoff-boxy-mobile-vivid-heading (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 979353bc7d77343797621496972688b79dddd8688f1e1021b04a04c4d0572b31 On require of the package, runtime.js selects a platform-specific asset path and fetches an opaque binary over HTTPS from Cloudflare Workers hosts...

Malicious code in tinkoff-boxy-desktop-features-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9792640803b7c90320c995d134baefcd36a52037d1947a3c0262c9d9e5ada168 The package's main entry index.js requires./setup at load time. setup.js assembles obfuscated Cloudflare Workers hostnames via array-join concatenati...

MAL-2026-12049 Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...