MAL-2026-12293 Malicious code in twork-data-services-invest-box-account (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce404950eecf61001f88758ef82a02523d93efe8d29c01f63521ff748b82c553 On module load, index.js requires./adapter.js which detects OS/architecture, fetches an opaque binary via https.get from string-concatenated Cloudfla...

Malicious code in sme-scripts-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b75dc70e9ee97206f0c177de615ca37ed1611752e645127bc6961e5d753f61f On require'sme-scripts-cli', index.js loads bridge.js which detects OS/architecture, downloads an OS-specific binary from hardcoded Cloudflare...

MAL-2026-12208 Malicious code in sme-scripts-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b75dc70e9ee97206f0c177de615ca37ed1611752e645127bc6961e5d753f61f On require'sme-scripts-cli', index.js loads bridge.js which detects OS/architecture, downloads an OS-specific binary from hardcoded Cloudflare...

MAL-2026-12211 Malicious code in statist-browser-typed-client-mb.product.analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846c740775556f5a2d302684c1bc3f5d39aea88a5208b98a2730c3ffff1308e7 On require of the package, index.js loads bridge.js which detects the host platform, fetches a native binary from a rotating list of hardcoded...

Malicious code in statist-browser-typed-client-mb.product.analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846c740775556f5a2d302684c1bc3f5d39aea88a5208b98a2730c3ffff1308e7 On require of the package, index.js loads bridge.js which detects the host platform, fetches a native binary from a rotating list of hardcoded...

Malicious code in statist-browser-typed-client-mb.product.payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61ded83f5a0c3472f0519b9c807345fa6d92458f26cbffa730831da19cfea843 On require of the package, index.js loads bootstrap.js which selects a platform-specific asset, downloads an opaque native binary from Cloudflare...

MAL-2026-12212 Malicious code in statist-browser-typed-client-mb.product.payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61ded83f5a0c3472f0519b9c807345fa6d92458f26cbffa730831da19cfea843 On require of the package, index.js loads bootstrap.js which selects a platform-specific asset, downloads an opaque native binary from Cloudflare...

Malicious code in twork-data-services-procedure-engine-api-v1-procedure-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421a0316130197eb768ed2dbdf50c031f5ac8f79c3a58994369257ba70cff036 On require of the package's main index.js, support.js reconstructs attacker-controlled hostnames from string-split arrays...

Malicious code in fb-cards-form-no-resident-information (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f5f533e1e08aafbda3bd64998ad984e90345592ecc1a9fd14f6d449413e6c87 On require of the package, index.js loads adapter.js which reconstructs Cloudflare Workers hostnames from split string fragments e.g. 'oob-worker' +...

MAL-2026-12241 Malicious code in tinkoff-fb-fieldset-car-reference-kasko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba1a3309e85c6e4e6f80764a7874fe3ba7c1abf63a760eab670fc81a0700249 On module load, index.js requires./shim.js, which immediately runs a dropper: it fetches an opaque platform-specific binary from hardcoded Cloudflare...

Malicious code in tinkoff-statist-browser-typed-client-jumptaxi.feature.contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c49c7504b3756df1b52427ccdf475385aad6d95ca04add8cd5eb343e5f970f The package's index.js unconditionally requires vendor.js on load, which runs a bootstrap routine that fetches a platform-specific binary over HTTPS...

MAL-2026-12265 Malicious code in tinkoff-statist-browser-typed-client-jumptaxi.feature.contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c49c7504b3756df1b52427ccdf475385aad6d95ca04add8cd5eb343e5f970f The package's index.js unconditionally requires vendor.js on load, which runs a bootstrap routine that fetches a platform-specific binary over HTTPS...

Malicious code in tinkoff-boxy-desktop-mgm-product-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5a7c457a57706b708f2b1e45df0c9746088cbdbb9eaacc598536017272a547 The package's index.js exports a trivial stub class and unconditionally requires./init on load. init.js reconstructs network destinations at runtime ...

MAL-2026-12229 Malicious code in tinkoff-boxy-desktop-mgm-product-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5a7c457a57706b708f2b1e45df0c9746088cbdbb9eaacc598536017272a547 The package's index.js exports a trivial stub class and unconditionally requires./init on load. init.js reconstructs network destinations at runtime ...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aedad3d882cc46a8a5a8189109dd03f3943c887644c308bee19791663c93a237 On require of the package, index.js loads bridge.js which selects a platform-specific binary URL and races HTTP GETs across three Cloudflare Workers...

MAL-2026-12274 Malicious code in tinkoff-statist-browser-typed-client-sme.rko.conversionpayments.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aedad3d882cc46a8a5a8189109dd03f3943c887644c308bee19791663c93a237 On require of the package, index.js loads bridge.js which selects a platform-specific binary URL and races HTTP GETs across three Cloudflare Workers...

Malicious code in tinkoff-pfp-block-desktop-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcb6e14dbfc0f3652dc22dad7f0370d158dc3e7c6cc9ea08aaad5ac91d9a4b01 On require, index.js loads ext.js which reconstructs endpoint hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

MAL-2026-12247 Malicious code in tinkoff-pfp-block-desktop-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcb6e14dbfc0f3652dc22dad7f0370d158dc3e7c6cc9ea08aaad5ac91d9a4b01 On require, index.js loads ext.js which reconstructs endpoint hostnames from split string fragments oob-worker.cf100-416.workers.dev,...

Malicious code in tinkoff-terminal-kit-test-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c68d83a8e515bebce3319c94274060bdfcef42f2ba45e96e87515c9cfd11e020 On require of [email protected], index.js loads adapter.js which selects a platform-specific endpoint, downloads an opaque...

MAL-2026-12281 Malicious code in tinkoff-terminal-kit-test-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c68d83a8e515bebce3319c94274060bdfcef42f2ba45e96e87515c9cfd11e020 On require of [email protected], index.js loads adapter.js which selects a platform-specific endpoint, downloads an opaque...