MAL-2026-12981 Malicious code in bnpl-blocks-mobile-bnpl-button-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d860ca2d011c1e76bfee65b763f4a2d612dfad059ebbde41bb8cb79bc5680808 On require of the package, init.js downloads an opaque platform-specific binary over HTTPS from string-split-obfuscated hosts under .workers.dev...

Malicious code in @taskd/maritime-email-processor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a5aef29b4050fca18dd803428274de6072ff7412ecd134bd68dcc1f5e8fa150 The package's sole exported function emailProcessor in dist/index.mjs POSTs to a hardcoded endpoint https://job-api.alex-c92.workers.dev, sending the...