MSC-2026-12685

The npm package wix-ssr-thunderbolt-grid-polyfill version 0.1.0 contains embedded malicious code. It ships forged Wix Thunderbolt registry manifests rbwixui and rbdsgnsys that point the wixui namespace at this package's dist directory through Wix's static.parastorage.com unpkg mirror, so Wix...

Malicious code in @secauditb20y/sec-test-r3b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df7034b94531c8be5e9141c7a5cf73f552486c1b307672346a0e646e60207b7c package.json declares a postinstall script that runs node -e to invoke fs.writeFileSync, creating /tmp/PWNR3REAL/FIRED on the installer's machine whe...