{"id":"MAL-2026-17501","summary":"Malicious code in a11y-tabindex-manager (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ce127c3e1cadd4f544a5f2580f2db030e3d9e3667d7b0e3399d85b59eb354045)\na11y-tabindex-manager ships thunderboltRegistry.js, which executes an IIFE on module load that runs a series of local shell commands (cat /etc/hosts, whoami, id, pwd, ifconfig/ip addr, hostname, cat /etc/resolv.conf, uname -a, env | head -50) via child_process.execSync and POSTs each output over plain HTTP to the hardcoded endpoint http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. A separate beacon labeled 'rce-poc-v3' sends Node.js version, platform, and PID to the same host. child_process is acquired both directly and via a fallback that instantiates a new Module (new module.constructor()) and copies module.paths — an evasion technique to bypass simple require('child_process') scans. The package name resembles a generic accessibility helper, but the shipped registry entry performs host identity, network configuration, user, and environment-variable harvesting with no legitimate purpose.\n","modified":"2026-10-04T23:45:16.981364451Z","published":"2026-10-04T23:28:48Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-10-04T23:28:48Z","sha256":"ce127c3e1cadd4f544a5f2580f2db030e3d9e3667d7b0e3399d85b59eb354045","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-020976","import_time":"2026-10-04T23:40:47.6682475Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/a11y-tabindex-manager/v/1.0.0"}],"affected":[{"package":{"name":"a11y-tabindex-manager","ecosystem":"npm","purl":"pkg:npm/a11y-tabindex-manager"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"thunderboltRegistry.js","sha256":"a53862650d7a1ab9a06205c979ee666b010c8bca97a666ed1a2ab0fa256f8d32","tlsh":"858150a1f95df030a9c37838cb7f504aa4bb96672c2ceee474495ab01f39558017e5f4"}],"package_integrity":[{"filename":"a11y-tabindex-manager-1.0.0.tgz","hashes":{"sha1":"ca82fec412f83afdf436bdd7221fcf3c7803683f","sha512_sri":"sha512-ZR7Xx6CB6VafX1k2Mi7W+vPlKyqQMLs/jp+0zbkRS1vdaj6QlVjceewxD50PjT+qbUELJDTiloGWVOCeJrf9oA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/a11y-tabindex-manager/MAL-2026-17501.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}