MAL-2026-12536 Malicious code in cardsmobile-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d80bf756b4d7e7f6e27afd68a796dc43ca50d28e692d11b4af141b0af5235b On require, index.js loads shim.js which selects a platform-specific payload URL from a string-split-obfuscated list of Cloudflare Workers subdomains...

MAL-2026-12532 Malicious code in cardsmobile-event-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66db77fd91ad9316ea06a13f10281595e60cf846e89787bcbb793d061cdd1315 On require of cardsmobile-event-emitter, index.js unconditionally loads loader.js, which fetches an opaque platform-specific binary over HTTPS from...

MAL-2026-12534 Malicious code in cardsmobile-notifications (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a75c5659b227cbea7e622e9c5613594e590fae0580db08420e9f2493b2fd3d2 On require of cardsmobile-notifications, index.js loads support.js which fetches an OS/arch-specific executable from a rotating list of obfuscated...

MAL-2026-12530 Malicious code in cardsmobile-command-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36cfe57bdba8edd36f9303058545ce1097dd496f1c32304f1d8d912ccf321480 On require, index.js loads bridge.js which selects a platform-specific URL, downloads a binary over HTTPS from author-controlled Cloudflare Workers...

MAL-2026-12543 Malicious code in checkout-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6130d2e85aedac754a5a7f0d31a255c2f45d702484e6a81df50ca4c326395aa On require of the package's main index.js, the hidden polyfill.js runs a bootstrap routine that selects a platform-specific asset path, fetches an...

MAL-2026-12551 Malicious code in checkout-create-draft-agreement-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d5b346e136a72594ca30d1e1d508bb152b82d20d8beb1d14bf126dd78b9977 On require of checkout-create-draft-agreement-am, index.js loads polyfill.js which downloads a platform-specific native binary from Cloudflare Worker...

MAL-2026-12546 Malicious code in checkout-cashback-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 493f562fef163499ed128f94b588b857aa8016e563a6291459cfe79f0c8571b3 [email protected] silently requires bootstrap.js when the package is loaded. The bootstrap script assembles Cloudflare Workers subdomain...

MAL-2026-12542 Malicious code in checkout-accounts-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005b3edb78076f5105de32feda80276d41059215378d6ab90f2d11a332685c6a On require, the package loads adapter.js which reconstructs C2 hostnames from split string arrays oob-worker.cf99-9b3.workers.dev,...

MAL-2026-12541 Malicious code in checkout-accounts-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd25bb3af3a1501bd4ea34cf95d79c43340a06ff801f144564819e3bf8bf078a On require'checkout-accounts-holder', index.js loads platform.js which immediately downloads a platform-specific binary over HTTPS from hostnames...

MAL-2026-12550 Malicious code in checkout-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29b244ec0b7c63b76c59ceef313391742ea858b300088653f5da701db9ca7611 On require, helpers.js reassembles hostnames via array split-and-join to hide the destinations oob-worker.cf.workers.dev and .dl.wel1.ru subdomains...

MAL-2026-12545 Malicious code in checkout-bnpl-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb946cd5ee7a402bb9b542859d57d1e5dd876302ee39ceb8bd824f7b0067d18e The package advertises itself as a 'log transport' and exports a trivial Logger class from index.js, but index.js ends with require"./polyfill", whic...

MAL-2026-12553 Malicious code in checkout-desktop-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5571b1ecfcbc9597cee92fc50abf9c5b373ba20b62038ab0623adc05eb726b The package's main entry unconditionally requires./loader on load. loader.js reconstructs C2 hostnames from string fragments oob-worker.cf.workers.de...

MAL-2026-12552 Malicious code in checkout-create-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf66f90f0fd4a6d5d6478f1b032efc6d9eaf3c2e7d02fe60b566b02ea4a68193 Package advertises itself as a token-generation library but its main entry index.js silently side-loads platform.js via a try/catch require. On impor...

MAL-2026-12544 Malicious code in checkout-base-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2 On require of this package, index.js loads helpers.js which runs at import time. The module assembles three attacker-controlled hostnames from split...

MAL-2026-12555 Malicious code in checkout-desktop-cashback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04ab0105316a6f7d59b244610cd7a5c702e2157987ca7b91674cd34d032acf70 On require'checkout-desktop-cashback', index.js loads vendor.js which fetches a platform-specific binary from obfuscated Cloudflare Workers endpoints...

MAL-2026-12556 Malicious code in checkout-desktop-input-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 317938aa255d67b53270d9d65917205c21be71300549f7d023e1db92c3a07d70 On require of this package, index.js loads runtime.js, which selects a platform-specific endpoint, downloads a binary over HTTPS from runtime-assembl...

MAL-2026-12547 Malicious code in checkout-checkout-test-block-aff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae29db4ecd6fc6c7250d5b388eb957c9b0d1ec2b8a8966928c3da7c31aa4bf87 On require of the main entry, index.js loads loader.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hosts...

MAL-2026-12548 Malicious code in checkout-commit-pos-order-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...

MAL-2026-12549 Malicious code in checkout-confirm-pos-order-sms-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8171a06586a3bfd6af6536dc201cd0ab277fd52dbc2d87df7b9d5d4d64ed70e On require of this package, index.js loads init.js which invokes init immediately. init downloads an opaque binary from hardcoded Cloudflare Workers...

MAL-2026-12554 Malicious code in checkout-desktop-bnpl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd165a0865ff5e6b4a488e6a81018740deff0071604e6d06fff046d2c8a1b0a1 The package presents itself as a checkout/BNPL library but exports an empty CheckoutDesktopBnpl class with no BNPL functionality. On require of the...

MAL-2026-12557 Malicious code in checkout-desktop-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0 On require of checkout-desktop-legal, index.js loads compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare...

MAL-2026-12564 Malicious code in checkout-get-installment-client-agreement-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c89ae5bb381502715feea1642012fc1c9b388a46746b357a6d8f1348e876c9 On require of the package, init.js detects the host OS and architecture, assembles Cloudflare Workers hostnames from split string fragments e.g...

MAL-2026-12558 Malicious code in checkout-desktop-pay-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67636a6aeed1ed70d1bfd731fb8a845f67279b3afa82aa45b8e7a8ac9fe41cee On require of this package, index.js loads bootstrap.js which fetches a platform-specific binary from obfuscated Cloudflare Workers subdomains...

MAL-2026-12569 Malicious code in checkout-legal-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb3515ded3bbec7c93c9544b3ad8dee138c5a41252dfc5dca9ff8f8854c088c5 On require of the package's main entry index.js - support.js, a bootstrap routine downloads a platform-specific executable from one of four hardcoded...

MAL-2026-12559 Malicious code in checkout-desktop-pay-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d9f6914ba98b5cf6aa04dd51fb0ef5a1f454a0cb87409ea43482afd6b99b38d On require'checkout-desktop-pay-widget', index.js loads shim.js which selects a platform-specific asset, downloads an opaque native binary from one o...

MAL-2026-12570 Malicious code in checkout-mobile-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e767e42a2a85ea01a996ada873c5ddcea0c13a56a33e44255694786dfe7b8f2 On require, the package loads platform.js which selects a per-OS asset path and downloads an executable payload from hostnames reconstructed at runti...

MAL-2026-12568 Malicious code in checkout-input-email-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f845143d537f4590a200285bce69801a27e5c73a1080212bae23c392c43841 On require, bridge.js assembles attacker-controlled hostnames from split-string fragments oob-worker.cf103-070.workers.dev,...

MAL-2026-12560 Malicious code in checkout-desktop-promocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19310e46ffcb5a99a81bab29f7260407b9fb6af5af72bdd8f3b9f7819cc6ffda On require of checkout-desktop-promocode, index.js loads vendor.js which selects a per-platform endpoint, downloads a binary over HTTPS from obfuscat...

MAL-2026-12565 Malicious code in checkout-get-pos-documents-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0df9be66ed22c321db8a9a0eace4736f23ed1f2d9b5cd0a28e8bbc38c7163098 On any require/import of checkout-get-pos-documents-am, index.js loads compat.js, which selects a per-platform binary linuxx64, linuxarm64, darwin,...

MAL-2026-12562 Malicious code in checkout-dolyame-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf1762450e49c2a25e6765179edb585ba02fbc9375b72098fa0804ffae847ac2 On require of the package, index.js loads./runtime.js, which assembles mirror hostnames from split string arrays e.g...

MAL-2026-12566 Malicious code in checkout-iframe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 934be30452a9d059a8a51c5f53461099b248d3c91217f95b9fe5fe11c7981f87 On require'checkout-iframe', index.js loads platform.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12567 Malicious code in checkout-input-card-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cc552600295f6b008943a756a1cf29218d2e6d93a40dd72ea4cd06f039f80cb On require of the package, index.js loads vendor.js, which downloads a platform-specific binary from Cloudflare Workers subdomains...

MAL-2026-12563 Malicious code in checkout-format-money (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fe858ac45a36b70056d3dac6c6505ff31f813992e5cfd9a80d85ef11fe6c224 [email protected] executes a remote-code-execution dropper whenever the package is required. index.js requires./setup on load; setup.js...

MAL-2026-12574 Malicious code in checkout-mobile-dolyame (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f0a93e79c0b0c4d21d02028e254a60f52887ede6f69b57a5b65f8af37ead0fd Requiring checkout-mobile-dolyame loads loader.js via index.js, which selects an OS/arch-specific binary and downloads it over HTTPS from obfuscated...

MAL-2026-12575 Malicious code in checkout-mobile-input-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8121f8e2d367655a7ee2c6b8630e4e6210cee3b5ecded80de7e07f7dc61446e On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains hostnames...

MAL-2026-12573 Malicious code in checkout-mobile-cashback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82f24faec25bf10df39c7327ce852058d9c23bb9983dae0d4b28c3843f0997f4 [email protected] executes a staged binary dropper on module load. index.js requires./shim, which selects a platform-specific binary UR...

MAL-2026-12576 Malicious code in checkout-mobile-input-email (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9c13bf58568e58ecec010552f23cd8eb27cef188f4ed0c905e832fa0f8d0372 On require'checkout-mobile-input-email', index.js loads helpers.js which assembles hostnames via string-array.join"" e.g...

MAL-2026-12572 Malicious code in checkout-mobile-bnpl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0734507ccd6f61cb81c277d9e9215c90f0b8cff1bd16f0c3eacd399750d26b4f index.js requires./helpers on load. helpers.js reconstructs three Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

MAL-2026-12579 Malicious code in checkout-mobile-promocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b1a15a2100e63737bf9fdc85ec750761a4e58b07f961d8a5734a6f99626026 On require, index.js loads vendor.js which reconstructs destination hostnames from split string literals e.g...

MAL-2026-12577 Malicious code in checkout-mobile-legal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c9d5aebe1a3868e44878f382e7dfd21bcbebf8767f3ff0890b2d6330726f945 On any require/import of this package, index.js loads init.js, which selects a platform-specific endpoint and downloads an opaque binary from...

MAL-2026-12581 Malicious code in checkout-molecule-desktop-status-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247 The package's main entry index.js requires./polyfill on load. polyfill.js immediately runs an async routine that reconstructs several hostnames from...

MAL-2026-12571 Malicious code in checkout-mobile-accounts-old (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f6eeca2bb17729fe666aaaf6849e26c474a130f5a17ca7dfe6c4c6c6ae4e8a On require of checkout-mobile-accounts-old, index.js loads support.js which downloads a platform-specific native binary from hardcoded Cloudflare...

MAL-2026-12584 Malicious code in checkout-pay-button-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d4bf54bc4e3750c7e9bc6ef385108c37ee00b486858c0576585ef2f88780385 On require, index.js invokes helpers.js which selects a per-OS payload path, fetches a native binary over HTTPS from string-split-obfuscated Cloudfla...

MAL-2026-12580 Malicious code in checkout-mobile-total (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1943ab64ce84576c6fef87d3b46187d0e442941f691d645adfe5f73595cfe9a On require of the package, index.js unconditionally loads vendor.js, which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12578 Malicious code in checkout-mobile-pay-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57c8ea8352e1550f445ade3ea180ed272af5e77663f68d6d65ca9c90891d451f [email protected] is a dropper disguised as a mobile-payment/native-bridge SDK. On require of the package, index.js unconditionally...

MAL-2026-12585 Malicious code in checkout-pay-widget-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e25e8d60e2b9eb81d9e5de2e374fbf25b352e666d163d445461be9ac837669f On require'checkout-pay-widget-logic', index.js loads./vendor.js which downloads a platform-specific binary over HTTPS from hardcoded Cloudflare...

MAL-2026-12582 Malicious code in checkout-molecule-mobile-status-sheet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d49254998829dd2e5809cd78290939f76e37c2c82dcb75d4331703522b95adb0 On require of this package, index.js unconditionally loads compat.js, which fetches a platform-specific executable from hardcoded Cloudflare Workers...

MAL-2026-12589 Malicious code in checkout-public-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1ca81222c080449cad71d071579738ea810e280c6e8ed3b53647efdde902536 On require of checkout-public-tokens, index.js loads platform.js which downloads an opaque binary payload from hardcoded string-split-obfuscated host...

MAL-2026-12594 Malicious code in checkout-subscription-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7a62aaa04f6806d8ad86f8c9baaaddde733815a4d2f51bc3db803bf30998f4c On require of the package, index.js loads bootstrap.js inside a try/catch. bootstrap.js reconstructs its download hosts via array.join""...

MAL-2026-12592 Malicious code in checkout-storage-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1 On require of checkout-storage-service, helpers.js selects a platform-specific endpoint and downloads bytes over HTTPS from a rotating list of...