MAL-2026-17556 Malicious code in css-ogojwh-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aff543635c832e0563229f42fcc7673c835f2ba5a9ae41d680aa572cfba49765 [email protected] presents itself as a CSS polyfill but ships thunderboltRegistry.js which, on require, runs an IIFE that executes shell...

Malicious code in css-nbanqq-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7377a70c94f8fd1719147b2023860926935a70410f672e07411326284f11a69f The package impersonates Wix thunderbolt internal registry modules exporting thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry,...

MAL-2026-17555 Malicious code in css-nbanqq-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7377a70c94f8fd1719147b2023860926935a70410f672e07411326284f11a69f The package impersonates Wix thunderbolt internal registry modules exporting thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry,...

MAL-2026-17549 Malicious code in css-display-reading-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b397798b7209f1094c33dc3ed721d4a3ef0536065317bd06bae76e33dd505334 The package ships payload.bundle.min.js, which on load runs an IIFE that invokes childprocess.execSync to run id, whoami, and uname, collects...

Malicious code in css-display-reading-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b397798b7209f1094c33dc3ed721d4a3ef0536065317bd06bae76e33dd505334 The package ships payload.bundle.min.js, which on load runs an IIFE that invokes childprocess.execSync to run id, whoami, and uname, collects...

Malicious code in @inpeek/odata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dad085b4b3e089d6a6d4e6812c66a8b45f10d40bc4ab39ea7bd0ce850d17ed4b @inpeek/[email protected] is a dependency-confusion placeholder published to the public npm registry on the unregistered @inpeek scope with an inflated...

MAL-2026-17542 Malicious code in @inpeek/odata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dad085b4b3e089d6a6d4e6812c66a8b45f10d40bc4ab39ea7bd0ce850d17ed4b @inpeek/[email protected] is a dependency-confusion placeholder published to the public npm registry on the unregistered @inpeek scope with an inflated...

Malicious code in @inpeek/odata-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 914508dbfa95a3d2cef5aef321a656215797f477c161a8c234e76256db6cac65 @inpeek/[email protected] is a dependency-confusion squat on the private @inpeek scope, published to the public npm registry at an inflated...

MAL-2026-17543 Malicious code in @inpeek/odata-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 914508dbfa95a3d2cef5aef321a656215797f477c161a8c234e76256db6cac65 @inpeek/[email protected] is a dependency-confusion squat on the private @inpeek scope, published to the public npm registry at an inflated...

Malicious code in @angulaar/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33d4a58c855f9b549d39f194483ee19730552bbb47a279f73237c8a403708d20 Package name '@angulaar/cli' double 'a' is a one-character edit of '@angular/cli'; README, LICENSE headers, and source files are copied verbatim from...

MAL-2026-17536 Malicious code in @angulaar/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33d4a58c855f9b549d39f194483ee19730552bbb47a279f73237c8a403708d20 Package name '@angulaar/cli' double 'a' is a one-character edit of '@angular/cli'; README, LICENSE headers, and source files are copied verbatim from...

MAL-2026-17510 Malicious code in internallib_v275 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80c1c6d383b3defb01da235e39e08ce56276d887e63d900aea2ee689836f71b4 index.js exports a command function that invokes /bin/bash -c to curl a reverse-shell payload from reverse-shell.sh targeting the hardcoded host...

Malicious code in internallib_v275 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80c1c6d383b3defb01da235e39e08ce56276d887e63d900aea2ee689836f71b4 index.js exports a command function that invokes /bin/bash -c to curl a reverse-shell payload from reverse-shell.sh targeting the hardcoded host...

Malicious code in minimal-a11y-contrast-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a198e6fb2c5e31bc841ff12f210e630abe8629853faf4ea961a124a9be8a25 Despite being advertised as a WCAG contrast checker, the package executes a self-invoking function at module load that runs host reconnaissance...

MAL-2026-17514 Malicious code in minimal-a11y-contrast-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a198e6fb2c5e31bc841ff12f210e630abe8629853faf4ea961a124a9be8a25 Despite being advertised as a WCAG contrast checker, the package executes a self-invoking function at module load that runs host reconnaissance...

MAL-2026-17518 Malicious code in postcss-gap-fallback-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b54d5bd893bc377a77503059998e01ae3e338fd4d8ddac6fe2d7c71a3157cb5 The package is published as a PostCSS gap fallback utility but ships thunderboltRegistry.js, which executes an IIFE on module load. The IIFE runs...

Malicious code in postcss-gap-fallback-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b54d5bd893bc377a77503059998e01ae3e338fd4d8ddac6fe2d7c71a3157cb5 The package is published as a PostCSS gap fallback utility but ships thunderboltRegistry.js, which executes an IIFE on module load. The IIFE runs...

Malicious code in popover-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9 The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that...

MAL-2026-17517 Malicious code in popover-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9 The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that...

Malicious code in rgx33-css-grid-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 320488b79c9000782e398425aa1a2fddba7f29a487913bbb2fc2019405c078f5 The package is published as rgx33-css-grid-utils but exports a set of module keys matching Wix thunderbolt internal registries thunderboltRegistry,...