Malicious code in css-mpmdds-polyfill (npm)

Source: amazon-inspector 4bac0cb0a2c693985668a890ff2ace72ff2d00dac60bc5470a77160c4d765106 The package presents itself as a CSS polyfill but ships thunderboltRegistry.js which runs an IIFE at module load. The IIFE acquires childprocess via multiple fallbacks require'childprocess',...

Malicious code in internallib_v923 (npm)

Source: amazon-inspector 2d02d4c28dbcb2db331a6da7dba2476e3b7daf4f4d53d51d76d79ad4732d28a4 index.js exports a command function that shells out via /bin/bash -c to curl a payload from reverse-shell.sh and pipe it to sh, yielding a reverse shell to the hardcoded callback host 10.0.72.151:443. Any...

Malicious code in @anuglar/core (npm)

Source: amazon-inspector 5f23ef78cc88817166cff7f8fdf3f1839c610880d960d9394e286da232058f98 Package name '@anuglar/core' is a one-character transposition of '@angular/core' and copies the legitimate package's description 'Angular - the core framework', author 'angular', and repository URL to...

Malicious code in css-display-reading-polyfill (npm)

Source: amazon-inspector b397798b7209f1094c33dc3ed721d4a3ef0536065317bd06bae76e33dd505334 The package ships payload.bundle.min.js, which on load runs an IIFE that invokes childprocess.execSync to run id, whoami, and uname, collects os.hostname, node version, process.platform, and pid, and transmi...

Malicious code in @inpeek/odata-angular (npm)

Source: amazon-inspector 914508dbfa95a3d2cef5aef321a656215797f477c161a8c234e76256db6cac65 @inpeek/[email protected] is a dependency-confusion squat on the private @inpeek scope, published to the public npm registry at an inflated version 99.99.102 to win resolution against an internal packa...

Malicious code in css-hgwctv-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee1103a16c6f933686f07e8ce94068057f49e5cf2f0a6a9ccf01f2baeb7cfe95 On require, thunderboltRegistry.js runs an immediately-invoked function that uses childprocess.execSync to collect host identity and network...

MAL-2026-17552 Malicious code in css-hgwctv-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee1103a16c6f933686f07e8ce94068057f49e5cf2f0a6a9ccf01f2baeb7cfe95 On require, thunderboltRegistry.js runs an immediately-invoked function that uses childprocess.execSync to collect host identity and network...

Malicious code in css-mpmdds-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bac0cb0a2c693985668a890ff2ace72ff2d00dac60bc5470a77160c4d765106 The package presents itself as a CSS polyfill but ships thunderboltRegistry.js which runs an IIFE at module load. The IIFE acquires childprocess via...

MAL-2026-17554 Malicious code in css-mpmdds-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bac0cb0a2c693985668a890ff2ace72ff2d00dac60bc5470a77160c4d765106 The package presents itself as a CSS polyfill but ships thunderboltRegistry.js which runs an IIFE at module load. The IIFE acquires childprocess via...

Malicious code in css-display-reading-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b397798b7209f1094c33dc3ed721d4a3ef0536065317bd06bae76e33dd505334 The package ships payload.bundle.min.js, which on load runs an IIFE that invokes childprocess.execSync to run id, whoami, and uname, collects...

MAL-2026-17549 Malicious code in css-display-reading-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b397798b7209f1094c33dc3ed721d4a3ef0536065317bd06bae76e33dd505334 The package ships payload.bundle.min.js, which on load runs an IIFE that invokes childprocess.execSync to run id, whoami, and uname, collects...

Malicious code in @inpeek/odata-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 914508dbfa95a3d2cef5aef321a656215797f477c161a8c234e76256db6cac65 @inpeek/[email protected] is a dependency-confusion squat on the private @inpeek scope, published to the public npm registry at an inflated...

Malicious code in @anuglar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f23ef78cc88817166cff7f8fdf3f1839c610880d960d9394e286da232058f98 Package name '@anuglar/core' is a one-character transposition of '@angular/core' and copies the legitimate package's description 'Angular - the core...

MAL-2026-17541 Malicious code in @anuglar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f23ef78cc88817166cff7f8fdf3f1839c610880d960d9394e286da232058f98 Package name '@anuglar/core' is a one-character transposition of '@angular/core' and copies the legitimate package's description 'Angular - the core...

Malicious code in internallib_v923 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d02d4c28dbcb2db331a6da7dba2476e3b7daf4f4d53d51d76d79ad4732d28a4 index.js exports a command function that shells out via /bin/bash -c to curl a payload from reverse-shell.sh and pipe it to sh, yielding a reverse...

Malicious code in focus-visible-polyfill-lite (npm)

Source: amazon-inspector 5225b5a8636a589f9b90272ad04c3f4104670a23d5c24b45f6aeaa757a4f2a2b The package is advertised as a focus-visible polyfill but ships thunderboltRegistry.js, which impersonates Wix thunderbolt internal registry modules thunderboltRegistry, siteAssetsRegistry,...

Malicious code in css-snap-target-polyfill (npm)

Source: amazon-inspector 00c104d427125b4acf88ecb83a58d563507b23bcb716cb87fbf7fc953d816d42 The package ships thunderboltRegistry.js, which uses childprocess and process.platform to collect host information and POSTs it via fetch to the hardcoded external endpoint http://dxpoc.gt.tc. The destinatio...

Malicious code in css-anchor-pos-fallback (npm)

Source: amazon-inspector bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05 The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id, whoami, uname -a, ifconfig/ip addr, and reads /etc/hosts, then POSTs th...

Malicious code in css-starting-style-polyfill (npm)

Source: amazon-inspector 713c302594ab7c41e8034ca95478045afafba98e223ea62def160f080cb879cd thunderboltRegistry.js runs an IIFE on module load that executes host reconnaissance commands via childprocess.execSync id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts and transmits the collected outp...

Malicious code in css-light-dark-polyfill (npm)

Source: amazon-inspector 856c154d7855924568c88181f172f46e84aac202bd6cb29974eb2ffaa3ec3ea7 The package presents itself as a trivial CSS polyfill index.js exports an empty object but ships thunderboltRegistry.js, which on load runs a self-invoking IIFE that collects host identifiers os.hostname, no...