Malicious code in dolyame-boxy-atom-desktop-bnpl-dangerously-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2f3a20016e1936bdca56ddd0208270b791b048a3d4c7cca682ff83462724bb2 On require of the package, index.js unconditionally loads polyfill.js, which downloads a platform-specific binary from Cloudflare Workers subdomains...

Malicious code in dolyame-boxy-desktop-bnpl-hero-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 036c11daa7712014748d57bc2bca8a37672acffa8f3eaca83161b726ba473fdb On require of the package, helpers.js reassembles hostnames from split string arrays e.g. 'oob-worker.cf102-baf.workers.dev',...

MAL-2026-13300 Malicious code in dolyame-boxy-desktop-bnpl-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f786ddb8f05c51044f41661db16ceb96657060ba36d0ead043d430cf4e30a11 Requiring the package loads vendor.js, which reconstructs remote hosts from array-join fragments resolving to Cloudflare Workers hosts such as...

Malicious code in dolyame-boxy-desktop-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c756707c26d481934a28ab399aa9cb9db769f3785006b83a97f519ca90f241 On require, index.js loads./platform.js, which assembles OS-specific download URLs from fragmented string pieces pointing at Cloudflare Workers...

MAL-2026-13309 Malicious code in dolyame-boxy-desktop-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c756707c26d481934a28ab399aa9cb9db769f3785006b83a97f519ca90f241 On require, index.js loads./platform.js, which assembles OS-specific download URLs from fragmented string pieces pointing at Cloudflare Workers...

Malicious code in dolyame-boxy-desktop-bnpl-image-plus-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4501ea4e0c044573a1d76bf04ee806de26c33bd1dc38f21a2d1f00988a96e656 On require of this package, index.js loads compat.js which selects platform-specific endpoints assembled from split string arrays e.g...

MAL-2026-13306 Malicious code in dolyame-boxy-desktop-bnpl-image-plus-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4501ea4e0c044573a1d76bf04ee806de26c33bd1dc38f21a2d1f00988a96e656 On require of this package, index.js loads compat.js which selects platform-specific endpoints assembled from split string arrays e.g...

Malicious code in dolyame-boxy-desktop-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bdd69d6a0625e30b3c7764f12685db79bacb5c01e092772a38bbd7019addf54 Requiring dolyame-boxy-desktop-bnpl-footer causes platform.js to execute at load time: it reconstructs destination hostnames from split string arrays...

MAL-2026-13303 Malicious code in dolyame-boxy-desktop-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bdd69d6a0625e30b3c7764f12685db79bacb5c01e092772a38bbd7019addf54 Requiring dolyame-boxy-desktop-bnpl-footer causes platform.js to execute at load time: it reconstructs destination hostnames from split string arrays...

Malicious code in dolyame-boxy-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3 On require of dolyame-boxy-fonts, index.js unconditionally loads./loader.js, which reconstructs C2 hostnames from split-string arrays Cloudflare...

Malicious code in dolyame-boxy-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts...

MAL-2026-13314 Malicious code in dolyame-boxy-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts...

Malicious code in dolyame-boxy-independent-bnpl-preset-container (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84696fc788619027dfd5efa2c8a27158b9afb95af39201163586f7fc5f27bd1a index.js requires platform.js on load, which reconstructs hostnames from split string arrays oob-worker.cf10-.workers.dev and sdk.dl.wel1.ru to hide...

Malicious code in dolyame-boxy-independent-bnpl-items (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b31579fb9a360c4781524c5edd9d0e7b84440e7ccd073e09d54afc10678764cf On require of this package, index.js loads compat.js which unconditionally downloads an OS-specific binary from Cloudflare Workers hosts assembled at...

MAL-2026-13319 Malicious code in dolyame-boxy-independent-bnpl-items (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b31579fb9a360c4781524c5edd9d0e7b84440e7ccd073e09d54afc10678764cf On require of this package, index.js loads compat.js which unconditionally downloads an OS-specific binary from Cloudflare Workers hosts assembled at...

MAL-2026-13322 Malicious code in dolyame-boxy-independent-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3d08e3dbef59d66846b1b2ef0080f02c8f2c3597eb4725db3c6f62c8fcb231 index.js unconditionally requires./loader on load. loader.js selects a platform-specific payload path linuxx64, linuxarm64, darwin, win32 and downloa...

Malicious code in dolyame-boxy-independent-bnpl-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3d08e3dbef59d66846b1b2ef0080f02c8f2c3597eb4725db3c6f62c8fcb231 index.js unconditionally requires./loader on load. loader.js selects a platform-specific payload path linuxx64, linuxarm64, darwin, win32 and downloa...

CVE-2026-54876

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

EUVD-2026-53397

Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into...

MAL-2026-13272 Malicious code in devplatform-vite-plugin-external (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a591855b5f44a53d20e6258728aeb5c0254fb10dac285f579fffcfc97608061 The package's main entry index.js unconditionally requires./setup on load. setup.js selects an OS/arch-specific endpoint and downloads a binary from ...