MAL-2026-12687 Malicious code in delivery-ci-upgrade-from (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b1b760480eca3b3ad596491193f7aa55ed0a3e982d6978c071e04e793ff8b0 index.js unconditionally requires bridge.js, which runs a bootstrap routine on module load. The bootstrap selects a platform-specific path linuxx64,...

MAL-2026-12695 Malicious code in devplatform-api-v2-resource-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde262833260cbba75c5fdd2160e0f91a6c43c0f7ad202b44475c649772c1174 [email protected] is an import-time dropper. The package's main entry index.js requires compat.js, which on load assembles C2...

MAL-2026-12692 Malicious code in devplatform-api-endpoint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a79a64efe72b14455f83f667581664c2369f92f669983a58cede299f70bcadc On require of the package's main entry, index.js unconditionally loads bootstrap.js, which fetches a platform-specific binary from Cloudflare Workers...

MAL-2026-12694 Malicious code in devplatform-api-v2-endpoint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f78874e3ff64b85f64b75f0481a7cadc00f15dea7b4f0eb85c1728a65ee2020 On require, index.js loads./vendor, whose top-level init fetches a platform-specific native binary from runtime-assembled Cloudflare Workers hosts...

MAL-2026-12693 Malicious code in devplatform-api-v1-endpoint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ed0defa1fbae571985664baae47d89d796f943b249115eb73a38edce04fb6c On require, adapter.js selects a platform-specific asset path and fetches an executable from string-split-obfuscated hosts under...

MAL-2026-12697 Malicious code in devplatform-api-v2-resources-metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cae6c0242748cb5392c3d1036f34fcb2e8dd6743abb4e94100665f1ce5b8dab Package presents itself as a REST API client wrapper, but requiring it loads platform.js which detects the host OS/architecture, fetches a...

MAL-2026-12691 Malicious code in devplatform-api-clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e548a0e6be161acd612b2729edd26e431f1bc4405e625daf957ede88db94e017 index.js unconditionally requires./setup.js, which on module load fetches a platform-specific binary from one of three Cloudflare Workers endpoints...

MAL-2026-12699 Malicious code in devplatform-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626164264796294f1cb4322c03454ff5d9c50f7f0edb7534bfb6a5843d08079d On require of devplatform-cli, index.js loads adapter.js which assembles Cloudflare Workers hostnames from string-split fragments e.g...

MAL-2026-12696 Malicious code in devplatform-api-v2-resources (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 186e6a9062d157dd85fb6e2ec2fc4a81294569d2cca0c2ade69f2e97075616ed On require of [email protected], index.js loads./polyfill.js, which downloads a platform-specific binary from anonymous Cloudflare...

MAL-2026-12698 Malicious code in devplatform-auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b5d92af4e479fded008aa25786634ef3869a37c3624f612a320d308808a0626 Requiring devplatform-auth-client loads bootstrap.js, which selects a platform-specific payload URL, downloads opaque bytes over HTTPS from hardcoded...

MAL-2026-12703 Malicious code in devplatform-cli-plugin-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 307cdf72132de0cbce8bbbe7fd65b7c89d9c879fd917ff6a9e06e41ff56d299e On require, runtime.js selects a platform-specific asset, downloads a binary over https.get from hardcoded Cloudflare Workers hosts with a DNS TXT...

MAL-2026-12705 Malicious code in devplatform-confirm-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68424c7a93599d9d6d9391e3236d1ebf1d88fdc590b9c20f1ee615295335e5e8 [email protected] is advertised as a 'confirm input adapter' but on require executes ext.js, which fetches a platform-specific binary...

MAL-2026-12700 Malicious code in devplatform-cli-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bc9fcdf16d7e6c67e3dbc20a6e8bdec551687bc20fffa3c434a35ca387ffade On require of the package, index.js loads compat.js which reconstructs destination hostnames from split string arrays e.g...

MAL-2026-12707 Malicious code in devplatform-create-nx-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6060fc08151209041eab336a6dcfdff0e78efb3a5d5dc7834df7e4f61ac03464 [email protected] ships an index.js main entry that silently requires bridge.js, which on load assembles Cloudflare Workers hostnames...

MAL-2026-12704 Malicious code in devplatform-cli-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bb41284069ba395bf67ceb847dc579c7a79c753ea89107116e91559ebbece2a On require'devplatform-cli-spa', index.js loads support.js which selects a payload by OS and architecture, downloads a native binary over HTTPS from...

MAL-2026-12702 Malicious code in devplatform-cli-plugin-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8460a9cc2fce88e69d25156ea88612a5a67ffba26709ce88900d573e2f4b3ea On require of the package, index.js loads bootstrap.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads an...

MAL-2026-12708 Malicious code in devplatform-data-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9d428dae035b88a4c025d9edd346d22cf2dffbb5a21ae597560702280b3949 On require'devplatform-data-table', index.js loads ext.js inside a swallowed try/catch. ext.js reconstructs a rotating list of Cloudflare Workers...

MAL-2026-12711 Malicious code in devplatform-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03e653399f20fec2b4b40c7c8921090939a1205110d866d23e4b605802cbc75d On require of devplatform-hooks, index.js loads init.js, which selects a platform-specific payload URL and fetches an executable from obfuscated...

MAL-2026-12709 Malicious code in devplatform-di (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3fd866e9abd20e9fa0c9ca40131d13b1ca98e2abbe73f53fd063581a65256d9 On require'devplatform-di', index.js loads compat.js which fetches a platform-specific executable from string-split-obfuscated hosts...

MAL-2026-12712 Malicious code in devplatform-http-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0232efebd49d07216da6eabd594c614076a3d1b414417d0d1be86d547a9c1adc On require of devplatform-http-client, index.js loads vendor.js which unconditionally invokes init. The routine selects a platform-specific payload...

MAL-2026-12701 Malicious code in devplatform-cli-plugin-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e369efa925874a9e8d5b883567522eb39e0284122294d62a92358b0b937f256f On require of the package, index.js loads bootstrap.js, which reconstructs a list of Cloudflare Workers hostnames from split string fragments...

MAL-2026-12706 Malicious code in devplatform-cra-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23e3df86e82704f0b114e616b4dc7f4acd0e5c377a336a61cb987625a31f3940 On require'devplatform-cra-template', index.js loads bootstrap.js, which selects a per-platform payload path and downloads bytes over HTTPS from one ...

MAL-2026-12710 Malicious code in devplatform-eslint-plugin-nx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35adb61664d8a7067c4ace2c143ed75e5e316dcd5365201ac8614ef9ff07e668 [email protected] is a typosquat lure targeting @nx/eslint-plugin. On require of the package, index.js loads runtime.js which...

MAL-2026-12720 Malicious code in devplatform-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9eab2b5f60c30ade507d29f76ffef745c0c12719aefb9f289d57f335288aeac4 [email protected] advertises itself as a markdown provider but on require of index.js loads adapter.js, which fetches a platform-specific...

MAL-2026-12725 Malicious code in devplatform-nx-pvm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58df39bb6ab40bc06f0c7db6a10753e81979cae9692633b51a33089ff6d28aa4 On require of devplatform-nx-pvm, compat.js fetches a platform-specific binary over HTTPS from hardcoded hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-12721 Malicious code in devplatform-npm-versions-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626fcec94d9938967e52e37c8973ffd825b75777018f0b58e6785036ff94d122 On require of the package, adapter.js fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-12723 Malicious code in devplatform-nx-gle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c9ada1c90c8e8217f9020f02c530477f38a6fd89338f415c815413498036faf On require of devplatform-nx-gle, index.js side-loads a sibling module bridge.js inside a swallowing try/catch. bridge.js reconstructs hardcoded...

MAL-2026-12726 Malicious code in devplatform-nx-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9293216b770bf95ede58df5d7aee19ded2826ca8fc027b44896474319483bb07 The package advertises itself as 'reusable nx react components' but its index.js unconditionally requires support.js, which fetches and executes an...

MAL-2026-12715 Malicious code in devplatform-iam-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494d7de346ffd38cb213791a60c0a1e19d6391e79643e052d31c8ac1e8028b3f The package presents a no-op DevplatformIamClient export, but index.js unconditionally requires./init.js on load. init.js selects a platform-specific...

MAL-2026-12717 Malicious code in devplatform-jscodeshift-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92dcd946aaaf9b57795f9a94877df34a69ac39828620c58e2cf4b72cd7a9c253 On require, index.js loads loader.js, which reconstructs Cloudflare Workers hostnames from split string fragments e.g...

MAL-2026-12714 Malicious code in devplatform-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b21acc89730541bc58390e2694a9e5410417e5232bb4f4d47c0c27b035e2f4 Package is published as an i18n library but its main entry index.js requires./setup on load. setup.js selects a per-platform payload path, fetches...

MAL-2026-12718 Malicious code in devplatform-jscodeshift-transforms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37b642060b8d602b0de19c132a792a4979dafc0cb06590dc2f10d14fe0980151 On require of the package, index.js loads shim.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts destinations...

MAL-2026-12716 Malicious code in devplatform-integrations-tests-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a69dc1ca445f24f40d0b4b24dc010a7d85c8994c65d215f2c6e5efe5dfac28f On require, bootstrap.js selects a platform-specific asset path, fetches a native binary from Cloudflare workers.dev hosts e.g...

MAL-2026-12727 Malicious code in devplatform-nx-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8fa5cc0213b5b28609ba1035cb25dd701d3e8690f25b5a3b4dc37f5139fa740 On require of the package, index.js loads support.js, whose top-level init selects a platform-specific asset, downloads a native binary from one of...

MAL-2026-12719 Malicious code in devplatform-jscodeshift-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...

MAL-2026-12722 Malicious code in devplatform-nx-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc4017373371f50665290c944ee840b2ad4a7e745dcb5eb973f977185b150ac7 The package presents as a devkit for the Nx ecosystem but ships a trivial no-op class in index.js alongside a hidden shim.js. On require, index.js...

MAL-2026-12729 Malicious code in devplatform-nx-svelte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a9e164d3a912ce2cb11abb935eb46fdfa9bb7ef12acbe4a305867cb8942306 On require of the package, compat.js constructs C2 hostnames by joining split string fragments to evade static inspection, downloads a...

MAL-2026-12732 Malicious code in devplatform-po-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 185d53460e4ec6534c0b4c8f3de1c0eb2d0134eaf161d8e0211a46bca273ad69 On require, the package loads platform.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac, /pkg/package.exe,...

MAL-2026-12724 Malicious code in devplatform-nx-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4cd991fb1b5e2308797829d38de8ba8b673c91a889e800621d01faef34610d devplatform-nx-husky is a typosquat blending the nx and husky ecosystem terms; its exported class is an inert no-op and the package has no legitimate...

MAL-2026-12713 Malicious code in devplatform-humanize-network-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d18ba9f3689dbc03127a3d82ffe0a6a2a15edf3e7f58b7ca9322499b2b68197 [email protected] advertises itself as a network-error humanizing utility, but on require its index.js unconditionally loads...

MAL-2026-12730 Malicious code in devplatform-nx-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d308883ce62856714651ea10d0051677eaa943f29b41c5cf94dd1614ba08d724 On require of the package, index.js loads compat.js which runs setup and downloads a platform-specific binary from Cloudflare Workers hosts whose nam...

MAL-2026-12728 Malicious code in devplatform-nx-stylelint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16573678cf46c8aabbd843cd3bbbbe258474f3768d15ad6f1178921b6ad964bf The package presents itself as an Nx stylelint helper but its main entry requires platform.js, which on load downloads a platform-specific executable...

MAL-2026-12731 Malicious code in devplatform-po-declaration-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3270e0e94deb3e2573594f28e84026653ee60f6c7f0a1fb79286ebba811ca525 On require, index.js unconditionally loads init.js, which selects a platform-specific binary for linux/darwin/win32, downloads it from Cloudflare...

MAL-2026-12742 Malicious code in devplatform-react-sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c8b0ca0cc6515e9f2709024217d665a13ee6ee2abfe66d57413a4901989fca On require, index.js loads loader.js which fetches a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf99-9b3.workers.de...

MAL-2026-12741 Malicious code in devplatform-react-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b482d551faa8ecb3cb337bd8bacfe5ec193f1bc2cad69b3998e935fbaf413efa The package's index.js requires./init on load. init.js reconstructs Cloudflare Workers hostnames via split-and-join obfuscation...

MAL-2026-12733 Malicious code in devplatform-po-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 555faac3cf4078b125af0858613813fb3f3bc780a573ddc5713b23d1046c9c71 On require of the package, platform.js detects OS/arch and downloads an opaque binary from Cloudflare Workers hostnames assembled at runtime from...

MAL-2026-12738 Malicious code in devplatform-react-query-clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 192681d10673d935bcba617102ed5581cc928ba8ebedda203cebe5d33d7f067a On require of the package, index.js loads adapter.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints...

MAL-2026-12736 Malicious code in devplatform-react-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e5dd30e287186df59dd24c05aa269894c259f42c8a2a214d513e55c6510474e On require of the package's main entry index.js - init.js, the module reconstructs a set of Cloudflare Workers hostnames from string-split fragments...

MAL-2026-12737 Malicious code in devplatform-react-micro-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38577b4e463996b1df19599f016c8ad16ebb36d8650effd666c93d844364c475 [email protected] is a lure package whose main entry auto-loads adapter.js on require. adapter.js selects a platform-specific...

MAL-2026-12734 Malicious code in devplatform-prettier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db5580fbae2ba8f21820a5ba50d8e632cfc12192c3f7cbaeccc8065b4cb5c57d Package presents itself as a prettier configuration/settings manager. index.js requires compat.js at module load, which downloads a platform-specific...