MAL-2026-17514 Malicious code in minimal-a11y-contrast-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a198e6fb2c5e31bc841ff12f210e630abe8629853faf4ea961a124a9be8a25 Despite being advertised as a WCAG contrast checker, the package executes a self-invoking function at module load that runs host reconnaissance...

MAL-2026-17515 Malicious code in monitoring-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 703c1e796904571c9f0d08a4769a5f7e25a646483b4a66815a6ddc420ae0ecee The package exports an Express middleware monitor advertised as a monitoring tool. On every response finish, the middleware POSTs the inbound HTTP...

Malicious code in monitoring-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 703c1e796904571c9f0d08a4769a5f7e25a646483b4a66815a6ddc420ae0ecee The package exports an Express middleware monitor advertised as a monitoring tool. On every response finish, the middleware POSTs the inbound HTTP...

Malicious code in postcss-gap-fallback-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b54d5bd893bc377a77503059998e01ae3e338fd4d8ddac6fe2d7c71a3157cb5 The package is published as a PostCSS gap fallback utility but ships thunderboltRegistry.js, which executes an IIFE on module load. The IIFE runs...

Malicious code in popover-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9 The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that...

Malicious code in tiny-viewport-unit-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34c221d8f8f0fedded27bfc22763912ffd96e9f3d1b2c08932e054ed418f493e The package ships thunderboltRegistry.js, a module that imports Node's childprocess primitives and executes whoami plus repeated ping commands agains...

Malicious code in rgx33-css-grid-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 320488b79c9000782e398425aa1a2fddba7f29a487913bbb2fc2019405c078f5 The package is published as rgx33-css-grid-utils but exports a set of module keys matching Wix thunderbolt internal registries thunderboltRegistry,...

Malicious code in rgx33-flex-layout-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02200327d66cf0661b787f58049b55b5fbb95dfb76fbb81a679cc71439bd85eb Package name and exports thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, etc. impersonate internal Wix thunderbolt registry...

Malicious code in wcag-color-a11y-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b6e72298f32298d6558f5d52eb7a9d5185b37fe8df14748bf61d6686dde1cb3 Package is advertised as a WCAG color accessibility helper library but ships thunderboltRegistry.js, an IIFE that on module load executes shell...

MAL-2026-17530 Malicious code in wcag-color-a11y-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b6e72298f32298d6558f5d52eb7a9d5185b37fe8df14748bf61d6686dde1cb3 Package is advertised as a WCAG color accessibility helper library but ships thunderboltRegistry.js, an IIFE that on module load executes shell...

Malicious code in css-scroll-state-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cffa0affc34bac3fa24fcc7c67aae4d120066f4f856cb8b637bc04c6ca9d482c The package presents itself as a CSS polyfill but ships a payload file thunderboltRegistry.js that executes an IIFE at require time. The IIFE uses...

CVE-2023-46021-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability

CVE-2023-46021-Code-Projects-Blood-Bank-1.0-OOB-SQL-Injection-Vulnerability مؤلف الاستغلال: ersinerenler الصفحة الرئيسية للمطور https://code-projects.org/blood-bank-in-php-with-source-code رابط البرنامج https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip نظرة عامة...

Malicious code in css-starting-style-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 713c302594ab7c41e8034ca95478045afafba98e223ea62def160f080cb879cd thunderboltRegistry.js runs an IIFE on module load that executes host reconnaissance commands via childprocess.execSync id, whoami, uname -a,...

MAL-2026-17488 Malicious code in css-starting-style-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 713c302594ab7c41e8034ca95478045afafba98e223ea62def160f080cb879cd thunderboltRegistry.js runs an IIFE on module load that executes host reconnaissance commands via childprocess.execSync id, whoami, uname -a,...

Malicious code in core-js-gnz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc57686b95f827f2c3b0501d97b6575e077247255bf5d4227ae9bc8bedd43937 On install, package.json runs node init.js as a postinstall hook. init.js collects host identifiers os.hostname, os.userInfo.username, os.platform,...

MAL-2026-17483 Malicious code in css-reading-flow-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b18e313d5fc67f07c1bcf051bd79a85dca97bb3c4510d9755efca6414bb55ff The package is published as css-reading-flow-polyfill but ships thunderboltRegistry.js, which impersonates internal Wix thunderbolt registry modules...

MAL-2026-17485 Malicious code in css-scroll-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36596ba9b9d8c0f994abe3cd87783f4f0dc880e63d55374d3555347ce349fab2 Package is published as css-scroll-anchor-polyfill but its index.js is empty and its contents impersonate internal Wix thunderbolt registry module...

Malicious code in css-scroll-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36596ba9b9d8c0f994abe3cd87783f4f0dc880e63d55374d3555347ce349fab2 Package is published as css-scroll-anchor-polyfill but its index.js is empty and its contents impersonate internal Wix thunderbolt registry module...

Malicious code in css-light-dark-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856c154d7855924568c88181f172f46e84aac202bd6cb29974eb2ffaa3ec3ea7 The package presents itself as a trivial CSS polyfill index.js exports an empty object but ships thunderboltRegistry.js, which on load runs a...

MAL-2026-17481 Malicious code in css-light-dark-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856c154d7855924568c88181f172f46e84aac202bd6cb29974eb2ffaa3ec3ea7 The package presents itself as a trivial CSS polyfill index.js exports an empty object but ships thunderboltRegistry.js, which on load runs a...