Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from...

Malicious code in dolyame-boxy-desktop-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51c824c84c8427ff1b81076d89a6d253b0d312f9eb28382311f601bbf4c5ceee The package main index.js requires ./init on load. init.js assembles hostnames via string-split .join'' obfuscation to produce a rotating list of...

MAL-2026-13311 Malicious code in dolyame-boxy-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3 On require of dolyame-boxy-fonts, index.js unconditionally loads./loader.js, which reconstructs C2 hostnames from split-string arrays Cloudflare...

MAL-2026-13317 Malicious code in dolyame-boxy-independent-bnpl-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f65bcb53883eb5b3dcd6fe4d8b8ee61e24dad3323aa4ee4431a62b770e17f7a On require, bridge.js downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints oob-worker.cf100-416.workers.dev,...

MAL-2026-13315 Malicious code in dolyame-boxy-independent-bnpl-code-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7222a6cf31e1412fd943bcf3b140b02f6c615b1650f9c39cabf813801557ae On require of the package, index.js loads ext.js which fetches a platform-specific executable from split-string-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-boxy-independent-bnpl-picture-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c2f5f635baa82fb1cc166956476dc3d7560c0c5d9e49a29aa4123256fdd9310 On require of the package, index.js unconditionally loads bootstrap.js, which selects a platform-specific endpoint and downloads an opaque binary fro...

MAL-2026-13324 Malicious code in dolyame-boxy-independent-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation...

Malicious code in dolyame-boxy-independent-bnpl-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f29e1e3b6b3a01a935dbcd19077e516c17d31c3674078ecfe2cd112b0137437 On require, index.js loads init.js which reconstructs hostnames from split-string arrays e.g. 'oob-worker.cf102','-baf.workers.','dev'.join'' and...

MAL-2026-13334 Malicious code in dolyame-boxy-independent-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 955003be540a21f5e2fd1a7a5a5586276a5cc7f733c09d1f5412250fe0035f1b On require of the package, index.js loads setup.js, which selects a platform-specific path, fetches an opaque binary from a rotating pool of Cloudfla...

Malicious code in dolyame-boxy-mobile-bnpl-card-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81f9a7ce9653fe40c88e75d2eebba37ae255fd0eb7e71cd9e962d34db491a218 On require, bootstrap.js downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints oob-worker.cf103-070.workers.dev,...

MAL-2026-13330 Malicious code in dolyame-boxy-independent-bnpl-swagger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c9922ed471321378d155bfabb5d15f3efe59f8524e30face28e25dadd3305b3 dolyame-boxy-independent-bnpl-swagger ships an index.js that unconditionally requires setup.js on load. setup.js reconstructs remote hostnames from...

MAL-2026-13331 Malicious code in dolyame-boxy-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd3ad7593e26ae49876e0310a51ac122ddcb6878eefddc74a5828cce061d200b On require of the package, index.js loads init.js which assembles obfuscated Cloudflare Workers hostnames oob-worker.cf.workers.dev from string-split...

Malicious code in dolyame-boxy-mobile-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d25f027b45e1dd0483fdacb92c8af5b25302f2785de7a7a5c259b8d535597d80 On require of the package, bootstrap.js fetches an opaque binary over HTTPS from a rotating list of Cloudflare Workers subdomains with a DNS-TXT...

MAL-2026-13332 Malicious code in dolyame-boxy-independent-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d558b476b362ab912d18912a13c79e326b5fcdcdbe73b0f292d94aa89ac732d On require of the package, index.js loads runtime.js, which assembles Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

MAL-2026-13340 Malicious code in dolyame-boxy-mobile-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eebb51211941909f17f499585ebb631497d8d82d142a5610518b55b87b144fb The package's main entry index.js requires./compat, which at import time downloads a platform-specific executable from author-controlled endpoints...

MAL-2026-13127 Malicious code in dolyame-boxy-mobile-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1830a31476314b9c1be462eba26a2314ed333d547a3f55bb62ff7ca44b5c9074 On require, index.js loads loader.js which selects a platform-specific payload path, fetches bytes over HTTPS from obfuscated hosts assembled via...

Malicious code in dolyame-boxy-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32273cf2b594fbdf7b09058c383c7d40319001732490771eda7931aaf01bf451 On require'dolyame-boxy-scroll', index.js loads ext.js which selects a platform-specific path linux/darwin/win32, downloads a binary from one of thre...

Malicious code in dolyame-boxy-stories (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0ef68742c490f223f00748b7f5dc82d614231b0d68e430736bbaac9175035e4 On require, index.js loads bridge.js which selects a platform-specific endpoint and downloads a binary from one of three attacker-controlled hosts...

MAL-2026-13132 Malicious code in dolyame-boxy-stories-of-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e18c95ca0abb6765cd4e9eb0ac8661962453f51c14d55902402a3b861d8ff16 On require of the package's main entry, index.js unconditionally loads support.js, which reconstructs hostnames from split-string arrays e.g...

MAL-2026-13124 Malicious code in ded-aa-liza-ded-aa-liza-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074f0a8014fabe8bdb281c1c07180290bcff2b10d67d723f1c7917ea198d5c5a On require of ded-aa-liza-ded-aa-liza-core, index.js loads ext.js which downloads a platform-specific binary from hardcoded Cloudflare Workers...