MAL-2026-12745 Malicious code in devplatform-rest-resources-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a9f72a6d741b5f055738486ee936f61ff645ed6dfdb0e34e746195da5b0d03 On require of the package, index.js loads bootstrap.js which selects a platform-specific endpoint, fetches an opaque native binary over HTTPS from...

Malicious code in devplatform-spa-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9cf6b251dcd1cb74d6b5dd84f62868d0213365ea555bbb8eb1d99dcdafedc26 index.js requires./polyfill on module load, which asynchronously fetches a platform-selected binary from runtime-assembled Cloudflare Workers...

MAL-2026-12755 Malicious code in devplatform-spa-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9cf6b251dcd1cb74d6b5dd84f62868d0213365ea555bbb8eb1d99dcdafedc26 index.js requires./polyfill on module load, which asynchronously fetches a platform-selected binary from runtime-assembled Cloudflare Workers...

MAL-2026-12764 Malicious code in devplatform-spa-plugin-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9000b7892808e2b10e702cb2b6f91fc672ad1bc0f58dfdc4c9cf2aa97edff896 On require of the package's main entry, support.js runs an init routine that assembles destination hosts from split string fragments...

Malicious code in devplatform-spa-plugin-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9000b7892808e2b10e702cb2b6f91fc672ad1bc0f58dfdc4c9cf2aa97edff896 On require of the package's main entry, support.js runs an init routine that assembles destination hosts from split string fragments...

Malicious code in devplatform-spa-plugin-suspense (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cbc392b622da2cfe503443ce6a7ee67083df8a9f6e371f13e1a7625f3379bd7 index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudflare Workers hosts...

MAL-2026-12781 Malicious code in devplatform-spa-plugin-suspense (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cbc392b622da2cfe503443ce6a7ee67083df8a9f6e371f13e1a7625f3379bd7 index.js requires setup.js at load, which downloads a platform-specific native binary from string-concat-obfuscated Cloudflare Workers hosts...

Malicious code in streak-metric-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d85f4f43ac36e53cc3254c7e5050d63105543deb781c8884046b7f5443fc3e21 On any require/import of streak-metric-core, top-level code in the main entry reconstructs a URL from String.fromCharCode integer arrays, resolving t...

MAL-2026-12808 Malicious code in streak-metric-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d85f4f43ac36e53cc3254c7e5050d63105543deb781c8884046b7f5443fc3e21 On any require/import of streak-metric-core, top-level code in the main entry reconstructs a URL from String.fromCharCode integer arrays, resolving t...

Malicious code in express-rate-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11 The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the...

MAL-2026-12378 Malicious code in express-rate-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11 The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the...

Malicious code in gekko-trading-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efc19985c853a3f4fdc8bdb1f08b432456b8f55ce701567edbf593fb3e6211c The package's postinstall hook runs setup.js, which unconditionally downloads core.exe from the hardcoded Cloudflare Workers subdomain...

Malicious code in pfp-block-mobile-past-meetup-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf58f1cbe01e2a0634ec464f040fc08dadf2df035af8c8a68d1fea1d51f10a85 On require of pfp-block-mobile-past-meetup-list, index.js loads ext.js which runs a bootstrap routine. It fetches a platform-specific binary via...

MAL-2026-12409 Malicious code in pfp-block-mobile-past-meetup-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf58f1cbe01e2a0634ec464f040fc08dadf2df035af8c8a68d1fea1d51f10a85 On require of pfp-block-mobile-past-meetup-list, index.js loads ext.js which runs a bootstrap routine. It fetches a platform-specific binary via...

MAL-2026-12380 Malicious code in fb-forms-form-boilerplate-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23bb3ca46733a388c550c5a1f6514c78b026447f355fcc669d1dfa0d58e8963a Package advertises itself as a form-boilerplate library but its top-level index.js unconditionally requires init.js, which on load downloads a...

Malicious code in eventea-diag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9941ff32c3b2d52ea7b7cccd4af391bfe359cf3766c4f22c484d1a51e178ab6c On require of the package, index.js loads shim.js which downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains...

MAL-2026-12373 Malicious code in eventea-diag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9941ff32c3b2d52ea7b7cccd4af391bfe359cf3766c4f22c484d1a51e178ab6c On require of the package, index.js loads shim.js which downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains...

Malicious code in afisha-storybook-default (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector feeb75800892fc0387942008f2de2a7fe3c9088df88d596afc7e3d1466262c13 On require of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscated mirror hosts...

Malicious code in bpm-foundation-feature-flags (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4736a188169920cb89859c87cc5d53ed9a51db4f368f15546f2b999a6ec12045 On require of bpm-foundation-feature-flags, index.js loads init.js which downloads a platform-specific native binary from obfuscated Cloudflare Worke...

Malicious code in tms-x-headers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d2d5c1a35629a169457029c69505622c3f6a7b6bdc8958480aea47ffe08266b On require of the package, helpers.js fetches a platform-specific binary from hostnames assembled by concatenating string fragments...