Malicious code in css-display-reading-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b397798b7209f1094c33dc3ed721d4a3ef0536065317bd06bae76e33dd505334 The package ships payload.bundle.min.js, which on load runs an IIFE that invokes childprocess.execSync to run id, whoami, and uname, collects...

MAL-2026-17549 Malicious code in css-display-reading-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b397798b7209f1094c33dc3ed721d4a3ef0536065317bd06bae76e33dd505334 The package ships payload.bundle.min.js, which on load runs an IIFE that invokes childprocess.execSync to run id, whoami, and uname, collects...

Malicious code in a11y-tabindex-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce127c3e1cadd4f544a5f2580f2db030e3d9e3667d7b0e3399d85b59eb354045 a11y-tabindex-manager ships thunderboltRegistry.js, which executes an IIFE on module load that runs a series of local shell commands cat /etc/hosts,...

MAL-2026-17501 Malicious code in a11y-tabindex-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce127c3e1cadd4f544a5f2580f2db030e3d9e3667d7b0e3399d85b59eb354045 a11y-tabindex-manager ships thunderboltRegistry.js, which executes an IIFE on module load that runs a series of local shell commands cat /etc/hosts,...

Malicious code in dom-focus-sentinel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7baf5178b3cd02ae8e6e2c01e8cf305fd9670118428c4d3ef94ac0caef6fc4e8 thunderboltRegistry.js runs an immediately-invoked function at module load that uses childprocess.execSync to run host reconnaissance commands whoami...

MAL-2026-17503 Malicious code in dom-focus-sentinel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7baf5178b3cd02ae8e6e2c01e8cf305fd9670118428c4d3ef94ac0caef6fc4e8 thunderboltRegistry.js runs an immediately-invoked function at module load that uses childprocess.execSync to run host reconnaissance commands whoami...

Malicious code in postcss-gap-fallback-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b54d5bd893bc377a77503059998e01ae3e338fd4d8ddac6fe2d7c71a3157cb5 The package is published as a PostCSS gap fallback utility but ships thunderboltRegistry.js, which executes an IIFE on module load. The IIFE runs...

MAL-2026-17518 Malicious code in postcss-gap-fallback-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b54d5bd893bc377a77503059998e01ae3e338fd4d8ddac6fe2d7c71a3157cb5 The package is published as a PostCSS gap fallback utility but ships thunderboltRegistry.js, which executes an IIFE on module load. The IIFE runs...

Malicious code in popover-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9 The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that...

MAL-2026-17517 Malicious code in popover-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9 The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that...

Malicious code in rgx33-css-grid-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 320488b79c9000782e398425aa1a2fddba7f29a487913bbb2fc2019405c078f5 The package is published as rgx33-css-grid-utils but exports a set of module keys matching Wix thunderbolt internal registries thunderboltRegistry,...

MAL-2026-17520 Malicious code in rgx33-css-grid-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 320488b79c9000782e398425aa1a2fddba7f29a487913bbb2fc2019405c078f5 The package is published as rgx33-css-grid-utils but exports a set of module keys matching Wix thunderbolt internal registries thunderboltRegistry,...

MAL-2026-17521 Malicious code in rgx33-flex-layout-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02200327d66cf0661b787f58049b55b5fbb95dfb76fbb81a679cc71439bd85eb Package name and exports thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, etc. impersonate internal Wix thunderbolt registry...

Malicious code in rgx33-flex-layout-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02200327d66cf0661b787f58049b55b5fbb95dfb76fbb81a679cc71439bd85eb Package name and exports thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, etc. impersonate internal Wix thunderbolt registry...

Malicious code in tiny-dom-focus-trap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84262096595a1e0ce09bbaa359930cd07cf420cc72545174ddc4f12c60bec962 The package is advertised as a focus-trap utility but thunderboltRegistry.js runs an IIFE at require time that uses childprocess.execSync to run...

MAL-2026-17526 Malicious code in tiny-dom-focus-trap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84262096595a1e0ce09bbaa359930cd07cf420cc72545174ddc4f12c60bec962 The package is advertised as a focus-trap utility but thunderboltRegistry.js runs an IIFE at require time that uses childprocess.execSync to run...

MAL-2026-17502 Malicious code in botmaker-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86fdc86c67d202ca9938942ef7786534d1b72169187cce13b1cefd8899fa54aa On npm install, postinstall.js collects the installer's hostname, username, current working directory, architecture, platform, and network interface...

Malicious code in css-starting-style-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 713c302594ab7c41e8034ca95478045afafba98e223ea62def160f080cb879cd thunderboltRegistry.js runs an IIFE on module load that executes host reconnaissance commands via childprocess.execSync id, whoami, uname -a,...

MAL-2026-17488 Malicious code in css-starting-style-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 713c302594ab7c41e8034ca95478045afafba98e223ea62def160f080cb879cd thunderboltRegistry.js runs an IIFE on module load that executes host reconnaissance commands via childprocess.execSync id, whoami, uname -a,...

Malicious code in css-reading-flow-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b18e313d5fc67f07c1bcf051bd79a85dca97bb3c4510d9755efca6414bb55ff The package is published as css-reading-flow-polyfill but ships thunderboltRegistry.js, which impersonates internal Wix thunderbolt registry modules...