MAL-2026-13042 Malicious code in boxy-esm-shims (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8f8bbecdfed31ec416782f6de127cb1003692978560504d748acd121b30fa3b On require of the package, index.js loads vendor.js which fetches an opaque binary from string-obfuscated Cloudflare Workers hosts...

MAL-2026-13038 Malicious code in boxy-deps-calculator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b0faa243ad4d8a3f6d3b76b94da84738fcd5a097efc0c2e920b4f029b76f970 setup.js runs at install time: it performs an HTTPS reconnaissance request https.get to a remote host with an identifier payload and then spawns a...

MAL-2026-13046 Malicious code in boxy-fixture-pendel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbad559799410017202aafce879de36d171f9480e4cd995e4e5fe5cb3bddb830 On require'boxy-fixture-pendel', index.js loads support.js which asynchronously downloads a platform-specific binary from obfuscated destinations...

MAL-2026-13044 Malicious code in boxy-fixture (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb575dd1ac71dc5968106b313680bb84dd0d90172e82c1a79887b085ba55b4bd On require of the package, index.js loads support.js which executes setup at module load. The code reconstructs Cloudflare Workers hostnames...

MAL-2026-13045 Malicious code in boxy-fixture-paperclip (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78a47f722fb30af7936e07182fa5fb42ecfd7efbacadd970a148a8a7daefc8e2 On any require/import, index.js loads adapter.js, which selects a platform-specific asset and downloads an opaque binary from a rotating set of...

MAL-2026-13059 Malicious code in boxy-maker-extendable-minihost (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08404cdfbfce9c8e1f4d6b5c4597504b8d1ee580eabfaa960e5d928b4d5505a4 On require, index.js loads bridge.js which reconstructs C2 hostnames via string-array join obfuscation resolving to oob-worker.cf101-3-.workers.dev...

MAL-2026-13047 Malicious code in boxy-fixture-pfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a15e41a397b63d04216419ddd8ec88f37cb68c5d35997ad840543e034f87d8f On require of the package, polyfill.js downloads a platform-specific binary from hardcoded destinations reassembled at runtime from split-string arra...

MAL-2026-13049 Malicious code in boxy-get-retry-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bd36db17d5636ee0cd74be0ca5d35fc190e75749360c297ecd52821d74ab8b8 On require, index.js delegates to helpers.js which selects a platform-specific asset path, downloads an opaque binary over HTTPS from obfuscated...

MAL-2026-13061 Malicious code in boxy-maker-page-readiness (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 273f130823f6759922a2e1d6f7c58ba24b9df17f7c08c6f6e43b0818b5aad4ed index.js unconditionally requires bootstrap.js on module load. bootstrap.js reassembles hostnames from split-string arrays e.g...

MAL-2026-13052 Malicious code in boxy-lcd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c7174f43951c87b6b7ffb67430170a9b655978a1fe64654729c87fe35ced60 The package's index.js top-level requires setup.js, which on load fetches an OS-specific executable from string-concat-obfuscated Cloudflare Workers...

MAL-2026-13054 Malicious code in boxy-live (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2804acf2e6e6e87de8651cf13574290daa1a3a59bb556d8f225d2d6d2abd8783 On package load, index.js requires loader.js, whose top-level start fetches a platform-specific unsigned binary from Cloudflare Workers hosts whose...

MAL-2026-13057 Malicious code in boxy-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1164ada14e000c3802b5766cdd31ef169e8f15a6d132cbe52d88b0c593b03c2a On require of the package, bridge.js downloads a platform-specific binary from obfuscated Cloudflare workers.dev hosts...

MAL-2026-13051 Malicious code in boxy-lazy-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5305d4b9e5c2859a6d53cc43cff86663c35902910301d561a4958b21c807d75 On require, index.js loads ext.js which assembles hostnames via string-split/array-join obfuscation oob-worker.cf100,1,2-.workers.dev, with a DNS-TXT...

MAL-2026-13055 Malicious code in boxy-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdf7f097e307514d03c7f01bcb81f3efaab713337c948068679c90fc9a2b220c On require'boxy-loader', index.js loads adapter.js which executes setup at module top level. setup picks a platform-specific remote path, downloads a...

MAL-2026-13062 Malicious code in boxy-maker-readiness (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47b6eaa6662082b79fce51e2ed8c152fa566d22ecb3b27311bbea6b069f25b14 On require, index.js loads shim.js, which selects a platform-specific asset, downloads a binary over HTTPS from a randomized list of Cloudflare Worke...

MAL-2026-13053 Malicious code in boxy-legacy-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8102d4aaa8c2a93380336ea524f83a3025cd00c71104060245f2143ba1b2694e On require of the package's main entry, index.js loads shim.js which unconditionally executes a dropper: it selects a platform-specific payload,...

MAL-2026-13060 Malicious code in boxy-maker-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa86d66c8cd9a63a566e94925453ec6b5d144da1adff066c7cf861ae0a02be5b On require of the package, runtime.js runs a bootstrap routine that downloads a platform-specific binary from obfuscated Cloudflare Workers subdomain...

MAL-2026-13056 Malicious code in boxy-make-tokens-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3b24115f2a42bc7aa25741e66f56e8007a3d0816cab809e1da78740f9a7a2d5 index.js unconditionally requires./loader on module load. loader.js reconstructs three Cloudflare Worker hostnames oob-worker.cf99-9b3.workers.dev,...

MAL-2026-13050 Malicious code in boxy-global-modules-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce609c23d8c990c21c16692270dbb62589c6f63e716994c31e5ed4f466dcad7 On require of the package's main entry, loader.js immediately fetches a platform-specific opaque binary over HTTPS from hardcoded Cloudflare Workers...

MAL-2026-13058 Malicious code in boxy-maker-bus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8e609c87c0dbbf2a870faf3c1e8ea2b322b32d147974f4ec62c400fd026744a [email protected] acts as a load-time dropper. The package's index.js unconditionally requires compat.js on load, which assembles Cloudflare...

MAL-2026-13065 Malicious code in boxy-maker-sticky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc3701b8f91a045a21b2a07ba76082afea03e4aea2c9a87a1c1e40e2de88c3b0 On require of boxy-maker-sticky, index.js loads runtime.js which reconstructs C2 hostnames from split string fragments...

MAL-2026-13064 Malicious code in boxy-maker-skeleton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06892152f894a88b72854f0773f64e68336cf6726fd0acc4b3d83c87f06301d3 On require of boxy-maker-skeleton, index.js loads compat.js which reconstructs destination hostnames by string-splitting/join to hide them from stati...

MAL-2026-13067 Malicious code in boxy-micro-story (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99c59fb669f0608d2c5f3362289aa05a77d09106393fd5370c207509878fe96f On require of the package, index.js loads platform.js which auto-executes an init routine that selects a platform-specific payload, fetches an opaque...

MAL-2026-13063 Malicious code in boxy-maker-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a06d379928c2633009c8dc7d89921205689ffb6ed8fa03ba74f67f557836c6f4 [email protected] executes a remote binary dropper the moment the module is loaded. index.js unconditionally requires polyfill.js, which selec...

MAL-2026-13068 Malicious code in boxy-mif-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4e9fe90e4c6a7334c75fffb7bd07fdeb785a35b9fc2c1a9e5ce74265296d1c7 On require of this package, index.js loads bridge.js which downloads a platform-specific native executable from string-split obfuscated Cloudflare...

MAL-2026-13077 Malicious code in boxy-render-unwrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26755161d9a2ac85d670783fc7eb67383b08592dbb67899b916d3e521d560420 On require of boxy-render-unwrap, index.js loads bootstrap.js which selects a platform-specific payload URL from a set of obfuscated mirror hosts...

MAL-2026-13073 Malicious code in boxy-mops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d377c600e4c23a91ca7b5c4465804849e0427d7f14392877ad961244142fe477 On require, boxy-mops loads compat.js, which assembles attacker-controlled hostnames from split string fragments resolving to...

MAL-2026-13066 Malicious code in boxy-maker-wave (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e064a8b2cd4e63ee24471673e5ac8f3cfb9ffae86a7e05eae7562395c3716b4 On require of the package, index.js loads platform.js which selects a platform-specific endpoint, downloads an opaque binary over HTTPS from Cloudfla...

MAL-2026-13069 Malicious code in boxy-mm-advisor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32b540f41a9d31185da353531b46adbb4d2bc9bd9b43efb79a4f8e80fbd51f8a On require of boxy-mm-advisor, index.js loads init.js which auto-runs init. The module reconstructs C2 hostnames via array-split-and-join obfuscation...

MAL-2026-13070 Malicious code in boxy-mm-server-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26c25489d15bfaaf8e337af2f2fa446e86fdc8cc5fae3199be2451bdb35196ef On require'boxy-mm-server-loader', index.js loads polyfill.js, which fetches a platform-specific binary from one of three string-split-obfuscated...

MAL-2026-13074 Malicious code in boxy-page-story (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cb3184221c24b500fca09d9e96c886b1ffe703d60b121150180b2387a87c48d On require, index.js loads./runtime, which reconstructs C2 hostnames from string-array concatenation to hide four...

MAL-2026-13084 Malicious code in boxy-sticky-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc08631cb79f90d5440020f420e9c7ad9e67ec84f25f085825c5b5f600f613a4 On require of the package, init.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at runtime from...

MAL-2026-13071 Malicious code in boxy-mmb-deps-pvm-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 088639f9b19ce8234cef116c0250628c6894bd509915aa90639c56436ec19646 index.js unconditionally loads polyfill.js on require. polyfill.js reconstructs attacker-controlled hostnames from split string literals...

MAL-2026-13075 Malicious code in boxy-pkg-deps-hash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1da74d1d4290df1bf3113989f436e444b8596103ce2a703bb0d6bcbbcff44e0a On require of the package, index.js loads adapter.js and unconditionally invokes setup. setup downloads a platform-specific binary from hardcoded...

MAL-2026-13072 Malicious code in boxy-mmb-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f98f3a2dd8ca593bdd127f3fd631a10fe4a3c70f57890aa43e2da45b92d18d80 index.js unconditionally requires loader.js on module load. loader.js reconstructs hostnames by joining split string fragments evading static grep to...

MAL-2026-13091 Malicious code in boxy-test-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a5cc17bc186bfb165d7341ea7832b66bc93cafaa6f849ccc840660735c0cfa5 On require of the package, index.js loads ext.js which assembles C2 hostnames from split string fragments oob-worker.cf102-baf.workers.dev,...

MAL-2026-13076 Malicious code in boxy-pkg-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae99d3d2f9b6c2a5a47e8edd34fb78968ffc58c3a514e04ad10b14455d7436f2 index.js unconditionally loads support.js on require. support.js reconstructs Cloudflare Workers hostnames oob-worker.cf100,1,2-.workers.dev and a.ru...

MAL-2026-13079 Malicious code in boxy-scroll-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c713e8e4ae3018f2614b7185c98b1f86dffcb684387e6a454d30a2c6eb8b89db On require of boxy-scroll-providers, index.js loads bootstrap.js which selects an OS-specific endpoint, downloads an opaque binary from obfuscated...

MAL-2026-13080 Malicious code in boxy-search-workspace-substrings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e86dee583e9f4fb1f10351062e6b4a9ddb6b4eae29b59677c1e8f4bf04711b6 On require of the package, index.js silently loads loader.js wrapped in an error-swallowing try/catch. loader.js reconstructs a set of destination...

MAL-2026-13089 Malicious code in boxy-test-block-fixture (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b10e5c9aa6fedcb9d29f292cd6f5aa6634e770f46c6385a9fb32c0fc628ab27a On require/import of the package, init.js assembles attacker-controlled hostnames at runtime by joining split string fragments resolving to...

MAL-2026-13092 Malicious code in boxy-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfb29953971bb0c3eae94e97f7a9efe132bd4a954252ae52c989f990f389d098 index.js unconditionally requires./setup.js on module load. setup.js assembles Cloudflare Workers hostnames from split-string arrays...

MAL-2026-13083 Malicious code in boxy-sitree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2be12f6af3487a38f7fa17ee8a4fd8a910f9dccffa351a8e19545781b2dfd3bc Requiring boxy-sitree triggers shim.js, which selects a platform-specific binary path, fetches an executable from Cloudflare Workers hosts assembled ...

MAL-2026-13078 Malicious code in boxy-rspack-optimize-sharing-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4136f667c5959249d83cd2f0a7322d10c005450c7ce18ae1c1723e0a017e80 The package's index.js unconditionally requires./bridge on module load. bridge.js selects a platform-specific payload path linuxx64, linuxarm64,...

MAL-2026-13090 Malicious code in boxy-test-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b9bbda2467ea797cb846a04b6a8c3bb71b3cfed619f7688f533050fa2f51eb [email protected] executes a remote binary dropper on any require of the package. index.js unconditionally loads bootstrap.js, which downloads a...

MAL-2026-13087 Malicious code in boxy-temper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3410beb63f55222c2e4d1823fae16f5de4cc07ec2ba428712d482737c72bbd2 index.js requires bridge.js on module load. bridge.js selects a platform-specific URL from a list of Cloudflare Workers hostnames whose strings are...

MAL-2026-13082 Malicious code in boxy-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ecbc929cc9a3cab12301c7879112bd95abb78812a0248415cc4f7c075d3eec1 On require of the package, index.js unconditionally loads compat.js, which reconstructs attacker-controlled hostnames from split string arrays...

MAL-2026-13088 Malicious code in boxy-test-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2ce2597c942a6017ba1aad05cadffba71e6673f8ae9298ef589493e3c4e5ad3 On require'boxy-test-block', index.js loads compat.js which reconstructs attacker-controlled destination hosts via string-split obfuscation...

MAL-2026-13096 Malicious code in boxy-validate-implicit-deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04288ec5388fa5634c253b28690e3e5b4b1220fbc9d07440fbb1c8a70860b0e5 On require of the package, index.js loads loader.js which selects a per-platform payload path and fetches an opaque binary from one of four hardcoded...

MAL-2026-13081 Malicious code in boxy-semver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec5b3e90530b4252cc04b1cf4cf70ec0113fa36f307ef33b28c80ff72ebdc83 index.js unconditionally requires./init on load. init.js downloads a platform-specific binary over HTTPS from hardcoded Cloudflare Workers hosts...

MAL-2026-13093 Malicious code in boxy-tree-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98d9e378c994473ce3e3be434420e616cf1f9f4cf4c71c2b61091a2dffe34ca5 On any require/import of the package, index.js loads ext.js which reconstructs four Cloudflare Workers destinations oob-worker.cf.workers.dev via...