MAL-2026-13051 Malicious code in boxy-lazy-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5305d4b9e5c2859a6d53cc43cff86663c35902910301d561a4958b21c807d75 On require, index.js loads ext.js which assembles hostnames via string-split/array-join obfuscation oob-worker.cf100,1,2-.workers.dev, with a DNS-TXT...

Malicious code in boxy-maker-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa86d66c8cd9a63a566e94925453ec6b5d144da1adff066c7cf861ae0a02be5b On require of the package, runtime.js runs a bootstrap routine that downloads a platform-specific binary from obfuscated Cloudflare Workers subdomain...

MAL-2026-13067 Malicious code in boxy-micro-story (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99c59fb669f0608d2c5f3362289aa05a77d09106393fd5370c207509878fe96f On require of the package, index.js loads platform.js which auto-executes an init routine that selects a platform-specific payload, fetches an opaque...

MAL-2026-13073 Malicious code in boxy-mops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d377c600e4c23a91ca7b5c4465804849e0427d7f14392877ad961244142fe477 On require, boxy-mops loads compat.js, which assembles attacker-controlled hostnames from split string fragments resolving to...

MAL-2026-13080 Malicious code in boxy-search-workspace-substrings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e86dee583e9f4fb1f10351062e6b4a9ddb6b4eae29b59677c1e8f4bf04711b6 On require of the package, index.js silently loads loader.js wrapped in an error-swallowing try/catch. loader.js reconstructs a set of destination...

Malicious code in bpm-foundation-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5 On require, index.js loads polyfill.js which performs an https.get to hardcoded Cloudflare Workers hostnames assembled by joining string fragments...

MAL-2026-12523 Malicious code in cards-forms-cards-core-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d987094f38a49c0bb9ae5329e3ff47d97489ee5af348ebc7e056e752cffc1fb On require, index.js loads runtime.js which detects OS and CPU architecture, reconstructs C2 hostnames from split string fragments...

Malicious code in certificates-revocation-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f10384b425fd13237d69f5a9d71f6c893bd9063b32be2665f8a30f95ddda837 On module load, index.js requires vendor.js which fetches a platform-specific binary from runtime-reconstructed Cloudflare Workers hostnames assemble...

MAL-2026-12549 Malicious code in checkout-confirm-pos-order-sms-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e On require of this package, index.js loads init.js which invokes init immediately. init downloads an opaque binary from hardcoded Cloudflare Workers...

Malicious code in checkout-desktop-pay-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67636a6aeed1ed70d1bfd731fb8a845f67279b3afa82aa45b8e7a8ac9fe41cee On require of this package, index.js loads bootstrap.js which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains...

Malicious code in checkout-mobile-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e767e42a2a85ea01a996ada873c5ddcea0c13a56a33e44255694786dfe7b8f2 On require, the package loads platform.js which selects a per-OS asset path and downloads an executable payload from hostnames reconstructed at runti...

Malicious code in checkout-mobile-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c9d5aebe1a3868e44878f382e7dfd21bcbebf8767f3ff0890b2d6330726f945 On any require/import of this package, index.js loads init.js, which selects a platform-specific endpoint and downloads an opaque binary from...

Malicious code in checkout-molecule-desktop-status-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247 The package's main entry index.js requires./polyfill on load. polyfill.js immediately runs an async routine that reconstructs several hostnames from...

Malicious code in checkout-post-installment-client-agreement-accept-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3562600b17ec6918b0ebfda948a4579addb4bf1d55a39c696bf6b10fcc15020f On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf100-416.workers.dev, oob-worker.cf102-baf.workers.dev...

MAL-2026-12595 Malicious code in checkout-test-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8dff84319052d8da1a322df80332f9d197a3e646f17c15b2fb5b53121f27dc0 On require of the package, index.js loads./runtime.js which unconditionally fetches a platform-specific executable from attacker-controlled Cloudflar...

Malicious code in checkout-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d17ce247f3e7fa94b43e93af7597a9ae8a2a4008048a1ae8deb9352f45fc731 On require of checkout-types, index.js loads vendor.js which runs setup at top level. The code reconstructs C2 hostnames from split string arrays...

Malicious code in checkout-use-toasts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bed98d203bbb9cb1a915db70566cfe33eb063a59e97c1e2f7607164b5a9c312e On require of checkout-use-toasts, index.js loads bridge.js which fetches an OS/architecture-specific native binary from runtime-assembled Cloudflare...

Malicious code in claims-get-base-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e7b7dbbb58284ead0ecb4d93490e9683b4f58b31955d817de52495fb7399106 index.js requires./setup on load, so any require of this package triggers a dropper chain. setup.js selects a platform-specific payload path...

MAL-2026-12619 Malicious code in claims-get-base-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e7b7dbbb58284ead0ecb4d93490e9683b4f58b31955d817de52495fb7399106 index.js requires./setup on load, so any require of this package triggers a dropper chain. setup.js selects a platform-specific payload path...

MAL-2026-12624 Malicious code in claims-historical-claims-api-adapters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7434149cb83ab4bb1378b89c5fd8165ce08bf714df3258c0a4b2ba67940c997 index.js unconditionally requires loader.js on module load. loader.js reconstructs remote hostnames from split string fragments e.g...