Malicious code in devplatform-spa-plugin-suspense (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cbc392b622da2cfe503443ce6a7ee67083df8a9f6e371f13e1a7625f3379bd7 index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudflare Workers hosts...

MAL-2026-12781 Malicious code in devplatform-spa-plugin-suspense (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cbc392b622da2cfe503443ce6a7ee67083df8a9f6e371f13e1a7625f3379bd7 index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudflare Workers hosts...

Malicious code in checkout-desktop-total (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under wel1.ru if HTTPS delivery fails. Systems that imported this package...

MAL-2026-12406 Malicious code in pfa-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e06752c5f827cccdf98f23fa26d893d44e2889b8b7011e8fdb130524f09fe0f On require'pfa-errors', index.js unconditionally loads runtime.js, which fetches a platform-specific opaque binary from one of three hardcoded...

Malicious code in sme-foundation-frame-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e9bb324a555c0f087f5366e156489724c0b1e06f8b1cdb08032046a0cc1f94d On require/import of the package, index.js unconditionally loads runtime.js, which downloads a platform-specific binary from hardcoded Cloudflare...

Malicious code in evo-web-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01a5ea39e9c916ea6155783b98eeb71551a8a7966edad05852816786e902ac92 On require, index.js auto-loads support.js which reassembles download hosts at runtime from string fragments e.g. Cloudflare Workers subdomains under...

Malicious code in statist-browser-typed-client-mb.product.mclaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1381b3c1cd52acc110406d4609b7afea6e0681e3fe1259fcff0cd0a819aacabc On require, index.js loads loader.js which selects a platform-specific binary path, fetches bytes from obfuscated Cloudflare Workers endpoints...

MAL-2026-12447 Malicious code in statist-browser-typed-client-mb.product.mclaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1381b3c1cd52acc110406d4609b7afea6e0681e3fe1259fcff0cd0a819aacabc On require, index.js loads loader.js which selects a platform-specific binary path, fetches bytes from obfuscated Cloudflare Workers endpoints...

Malicious code in eventea-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8a332e38d2400d3c15f34636f55191ca61c1d52ff49fbead378b9f9239de756 index.js unconditionally requires vendor.js on load. vendor.js selects a platform-specific payload path, downloads an opaque native binary over HTTPS...

MAL-2026-12374 Malicious code in eventea-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8a332e38d2400d3c15f34636f55191ca61c1d52ff49fbead378b9f9239de756 index.js unconditionally requires vendor.js on load. vendor.js selects a platform-specific payload path, downloads an opaque native binary over HTTPS...

Malicious code in bpm-foundation-feature-flags (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4736a188169920cb89859c87cc5d53ed9a51db4f368f15546f2b999a6ec12045 On require of bpm-foundation-feature-flags, index.js loads init.js which downloads a platform-specific native binary from obfuscated Cloudflare Worke...

Malicious code in fb-hr-sites--boxified-form-meetup-subcribe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8aa49d4f3babc81510150e766a38674e971d7553cb05d98b67d0edd24a2fa07 The package's index.js exports an inert class and silently requires./platform inside a swallowed try/catch. On load, platform.js downloads a...

Malicious code in statist-browser-typed-client-mb.reliability.android.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 452d03d6ed4b82fa956dc7419066742e9c91518b786f0e164aa63e2ae55d6083 On require of the package, index.js loads loader.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts assembled by...

Malicious code in pfp-forms-sme-sitebuilder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f0c2b9f45c8e537bcf70d98c1aa5daa263962eae954c2d871d978e0ac0dd64 index.js unconditionally requires./support on module load. support.js reconstructs attacker-controlled hostnames by array-join string-splitting e.g...

MAL-2026-12351 Malicious code in checkout-common-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe0e9681cb5e7a197ca8d77ba29e20a4709fa0ff476f2ffb02f935785c6633e0 On require, index.js loads ext.js which selects a platform-specific payload URL from a rotating list of Cloudflare Workers subdomains hosts assembled...

Malicious code in sme-scripts-shared-library-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a07df8d1831729273ad5bbc396191492c36cbf0f4d870af35c1101579ce0c9 [email protected] executes an install/import-time dropper. index.js requires./setup at module load, which selects a...

MAL-2026-12341 Malicious code in bnpl-blocks-independent-bnpl-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e70389e1435e74337e9c402d824a2e90eeb0b2e9f82fc670035973a18382c558 On require of the package, index.js loads runtime.js which downloads a platform-specific binary from runtime-assembled .workers.dev hosts...

MAL-2026-12413 Malicious code in pfp-forms-mobile-sme-group-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a17b2afbbc0ab147312c16ab39ed32f31061c185ff2dedbea76bdf5940dd2a On require, polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several .workers.dev hosts whose names ar...

MAL-2026-12453 Malicious code in statist-browser-typed-client-sme.rko.finance.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f8aa3f187231d6a828b8d3cd99eee3f0b3dbb95abecc8ebf1add2c393f59b15 On require of the package, support.js assembles remote hostnames from split-string array joins e.g. "oob-wo","rker.cf1","02-baf.workers.","dev".join"...

MAL-2026-12434 Malicious code in saas-f-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b4a492a289f0cc0ec0f924149b0cd29521c60747d6fe700d84d03ddddcd8a65 On require, index.js loads setup.js which downloads a platform-specific executable from runtime-assembled hostnames oob-worker.cf103-07.0.workers.dev...