{"id":"MAL-2026-782","summary":"Malicious code in ac-polyfills (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (98dfac851a08e8e8967e1386dadfd513226414b0ed65f6479a914479eb903878)\nac-polyfills@2.10.0 declares a preinstall lifecycle script in package.json (line 7-8) that runs `wget` to a hardcoded webhook.site collector URL (https://webhook.site/381d4406-8f87-4aab-961f-7a9496c21821/), sending the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as query parameters. This fires automatically on `npm install` with no user interaction, exfiltrating installer identity and host information to a third-party webhook collector. The package name and shape are consistent with a dependency-confusion probe targeting an internal package name.\n","modified":"2026-09-18T05:45:04.921362571Z","published":"2026-02-06T02:07:02Z","database_specific":{"malicious-packages-origins":[{"ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"0a7d9d049932519bded5d12b8627523ef63dac69179b1ce873cf4cd8b7fe6849","source":"amazon-inspector","import_time":"2026-02-06T03:03:38.130497165Z","modified_time":"2026-02-06T02:07:02Z"},{"import_time":"2026-03-19T12:18:32.051171561Z","modified_time":"2026-03-18T12:37:36Z","sha256":"90cff5e7a441b510af31deb23e35a368e629b0b7bec79e1afa01d9fc37c935b7","source":"reversing-labs","versions":["99.9.9"],"id":"RLMA-2026-01092"},{"sha256":"98dfac851a08e8e8967e1386dadfd513226414b0ed65f6479a914479eb903878","source":"amazon-inspector","versions":["2.10.0"],"id":"IN-MAL-2026-020180","import_time":"2026-09-18T05:39:51.317096608Z","modified_time":"2026-09-18T05:25:24Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ac-polyfills/v/2.10.0"}],"affected":[{"package":{"name":"ac-polyfills","ecosystem":"npm","purl":"pkg:npm/ac-polyfills"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["99.9.9","2.10.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"8a010234a330bb731ac256b204bd873fb531fba791156c0dafab221ad35ede200b9515","path":"package.json","sha256":"8c3dd253390bc47977519727afd6210fbebfb881f08387ec672899cfb33fa3c3"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-FTRwek4ZiQbzBe1kqZ0+rN3F4M/VCarYnS0NWA/IUaAfarVBDYOkJpF8erLXaFYIdaU0FYq0FQU9bzxaUuiQJw==","sha1":"654356a88d7e44ae90799eee1025f3219831a98b"},"filename":"ac-polyfills-2.10.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ac-polyfills/MAL-2026-782.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com","inspector-research@amazon.com"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}