MAL-2026-17483 Malicious code in css-reading-flow-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b18e313d5fc67f07c1bcf051bd79a85dca97bb3c4510d9755efca6414bb55ff The package is published as css-reading-flow-polyfill but ships thunderboltRegistry.js, which impersonates internal Wix thunderbolt registry modules...

Malicious code in css-reading-flow-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b18e313d5fc67f07c1bcf051bd79a85dca97bb3c4510d9755efca6414bb55ff The package is published as css-reading-flow-polyfill but ships thunderboltRegistry.js, which impersonates internal Wix thunderbolt registry modules...

MAL-2026-17485 Malicious code in css-scroll-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36596ba9b9d8c0f994abe3cd87783f4f0dc880e63d55374d3555347ce349fab2 Package is published as css-scroll-anchor-polyfill but its index.js is empty and its contents impersonate internal Wix thunderbolt registry module...

Malicious code in css-scroll-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36596ba9b9d8c0f994abe3cd87783f4f0dc880e63d55374d3555347ce349fab2 Package is published as css-scroll-anchor-polyfill but its index.js is empty and its contents impersonate internal Wix thunderbolt registry module...

MAL-2026-17480 Malicious code in css-interop-observer-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 089bdc1dd6bdf0216bb911888e81ce97dc171bdef2588fd5de0aadb4a64fbb2b On module load, thunderboltRegistry.js executes an IIFE that runs id, whoami, uname, ifconfig/ip addr via childprocess.execSync and reads /etc/hosts,...

Malicious code in css-interop-observer-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 089bdc1dd6bdf0216bb911888e81ce97dc171bdef2588fd5de0aadb4a64fbb2b On module load, thunderboltRegistry.js executes an IIFE that runs id, whoami, uname, ifconfig/ip addr via childprocess.execSync and reads /etc/hosts,...

MAL-2026-17484 Malicious code in css-relative-color-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee0efef48c7d56201a037b237f11ec712853f86e74f6a00ef8011732b31363f1 The package name advertises a CSS utility, but thunderboltRegistry.js runs an IIFE on module load that uses childprocess.execSync to execute whoami,...

MAL-2026-17478 Malicious code in css-field-sizing-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 549bb8820cb6a8a35853826d17b64df14c0561b83790192a33c5dc76dbad53b9 The package advertises itself as a CSS field-sizing polyfill but ships thunderboltRegistry.js, which runs an IIFE at module load time. The IIFE shell...

Malicious code in css-field-sizing-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 549bb8820cb6a8a35853826d17b64df14c0561b83790192a33c5dc76dbad53b9 The package advertises itself as a CSS field-sizing polyfill but ships thunderboltRegistry.js, which runs an IIFE at module load time. The IIFE shell...

MAL-2026-17479 Malicious code in css-gap-decorations-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8126656cc344a4f632b8ddf5a23683fc92ac22798bb67e1aed6bca73ac82d7b6 The package is published as a CSS polyfill but ships no polyfill functionality. On require, thunderboltRegistry.js uses childprocess.execSync to run...

Malicious code in css-gap-decorations-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8126656cc344a4f632b8ddf5a23683fc92ac22798bb67e1aed6bca73ac82d7b6 The package is published as a CSS polyfill but ships no polyfill functionality. On require, thunderboltRegistry.js uses childprocess.execSync to run...

MAL-2026-17491 Malicious code in focus-visible-polyfill-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5225b5a8636a589f9b90272ad04c3f4104670a23d5c24b45f6aeaa757a4f2a2b The package is advertised as a focus-visible polyfill but ships thunderboltRegistry.js, which impersonates Wix thunderbolt internal registry modules...

Malicious code in focus-visible-polyfill-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5225b5a8636a589f9b90272ad04c3f4104670a23d5c24b45f6aeaa757a4f2a2b The package is advertised as a focus-visible polyfill but ships thunderboltRegistry.js, which impersonates Wix thunderbolt internal registry modules...

CVE-2026-79766

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

CVE-2026-79766 Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

EUVD-2026-86161

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

CVE-2026-79766 Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

CVE-2026-79766

The web-based server management platform Termix (versions 2.4.1 through 2.5.0) contains an OS command injection vulnerability in its ACME/Let's Encrypt certificate-request handler. An authenticated administrator can supply attacker-controlled domain and email values via PATCH /users/acme-ssl-sett...

CVE-2026-79766 Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...

CVE-2026-79766: Improper Neutralization of Special Elements used in an OS Command

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation...