MAL-2026-13646 Malicious code in sme-rko-finance-front-operations-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85709f3e95d677177f1e55976d46cf4e16582e9cf3c1b310a7e67dd09885a743 On require of the package, index.js loads bridge.js which assembles Cloudflare Workers subdomain hostnames from split string fragments...

MAL-2026-13531 Malicious code in damir-cbr-dawdntrnssbf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b201b86e8198a519343eebfaa548af8848dcad42b507826b052f5c97fbcfa90f On require of the package, polyfill.js downloads a platform-specific binary from attacker-controlled Cloudflare Workers hosts...

Malicious code in dolyame-ui-buttonstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d10bbe41547b5406844f6d8c48d4d73e8f59cf6fe0f53544c636671b76baeb8 [email protected] is a dropper. index.js unconditionally requires setup.js on load, which selects a per-platform binary path, fetches...

Malicious code in bigops-microfrontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53767eeec6e6f398e15ba75b3143b7fba8eb0a803579e2788a55163393bb2789 index.js unconditionally requires./shim on load. shim.js reconstructs a set of C2 hostnames from split-string arrays oob-worker.cf99-9b3.workers.dev,...

MAL-2026-13247 Malicious code in bigops-products-travel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91399b954849c3483787f47cb7a54ed5784aba889c1ccafc13ff2f037b21af64 On require of the package's main entry, loader.js downloads a platform-specific binary from Cloudflare Workers hosts assembled via string-split...

Malicious code in bigops-storio-ngrx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6eb386f3b0d35ecf71762d0e719f883a3e1e207a2a3a9e1f52e7729de7753ae0 On require, index.js loads./ext.js which selects a per-OS asset path and downloads a binary payload from one of three runtime-assembled Cloudflare...

MAL-2026-13267 Malicious code in devplatform-test-pvm-is-even (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab114c230ec1d462306a74f0eaaddf32474b1fae0087e1038ab2e280637d558 The main entry index.js requires./runtime.js, which at load time assembles hostnames from split string arrays e.g. 'oob-worker.cf101-adf.workers.dev'...

MAL-2026-13269 Malicious code in devplatform-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated...

Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from...

MAL-2026-13184 Malicious code in dolyame-ui-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba7c3d2ae4bea9c6638aa21727d88df65e96361021b4c5d458eac472191c0e86 On require'dolyame-ui-slider', index.js loads bootstrap.js which selects a platform-specific asset path, downloads an opaque binary from one of three...

Malicious code in dolyame-ui-tag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62b169f56912efe4d5ade33f60cbc3f4b220ac0c447ff5821d8cd96635a1a67c On require of the package, index.js loads./ext, which downloads a platform-specific binary from Cloudflare Workers hosts assembled at runtime from...

MAL-2026-12860 Malicious code in bnpl-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eda2ee8ac0f1ffdce814e7ca4bb7e1c1ca52beebb7048b18a64d8e13e87abf4 The package presents itself as an empty API stub index.js exports a no-op BnplApi and unconditionally require"./support" on load. support.js assemble...

MAL-2026-12930 Malicious code in bnpl-blocks-desktop-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8dabd39ff50be1e1295dea75e71b63acd26c7617be87af38df3cdbaaee53302 index.js loads support.js at require time, which fetches a platform-specific binary linux/darwin/win32 variants under /pkg/package, /pkg/loadermac,...

Malicious code in bnpl-blocks-desktop-bnpl-image-with-caption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c639b4f00dd3629a927a4892681ebf399a957fe793132521d781bd9cc0ed0da On require of this package, index.js loads ext.js which selects a platform-specific asset name and downloads a native binary from obfuscated Cloudfla...

MAL-2026-12932 Malicious code in bnpl-blocks-desktop-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e0ae14a5603433798af1dda72f0e9c1ae60505afa9205177c558c208d362b5e On require of the package, index.js loads runtime.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from obfuscate...

MAL-2026-12988 Malicious code in bnpl-blocks-mobile-bnpl-feedback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28f1214c6f46b90fa1bf81bde9a79c81a5193e84969ef756f50cbf895c49515b On require of the package, index.js loads shim.js which selects a platform-specific binary from a list of string-split-obfuscated Cloudflare Workers...

Malicious code in bnpl-blocks-mobile-bnpl-news-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad0b3eb1ec7b37f8483e53212833b81d542aabb784a525e56ce3b2b6e1e48217 The package's index.js loads runtime.js on require, which selects a platform-specific asset, fetches an opaque binary over HTTPS from author-controll...

MAL-2026-12515 Malicious code in bpm-foundation-test-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de196f443359e53af966cb2ca288d90e59e708c2cf7ad33ab2e0e20b7df2869e On require, index.js loads setup.js which assembles destination hostnames at runtime from split string fragments resolving to...

MAL-2026-12571 Malicious code in checkout-mobile-accounts-old (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f6eeca2bb17729fe666aaaf6849e26c474a130f5a17ca7dfe6c4c6c6ae4e8a On require of checkout-mobile-accounts-old, index.js loads support.js which downloads a platform-specific native binary from hardcoded Cloudflare...

Malicious code in devplatform-jscodeshift-transforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37b642060b8d602b0de19c132a792a4979dafc0cb06590dc2f10d14fe0980151 On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts destinations...