@ai_/autoprefixers

{"schema_version":"1.7.4","id":"MAL-2026-11120","published":"2026-07-28T13:29:56Z","modified":"2026-08-05T13:10:38.020111761Z","summary":"Malicious code in @ai_/autoprefixers (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d)\n@ai_/autoprefixers@1.0.0 is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the string 'node:child_process' and loads it dynamically, then fetches two responses over plain HTTP from http://player.sweeprovider.org/getKey.php and http://player.sweeprovider.org/generateRandomKey.php, combines them, and passes the result to child_process.exec with silent:true. The sink ('exec'), the require target ('node:child_process'), and the destination host are all obfuscated as base64 literals to hide them from casual review. Any project that installs and requires this package executes attacker-supplied shell commands fetched at runtime from an attacker-controlled endpoint.\n","affected":[{"package":{"name":"@ai_/autoprefixers","ecosystem":"npm"},"versions":["1.2.0","1.0.0","1.1.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/autoprefixer.js","sha256":"62fcef4c2a7f6b277912c92ba62bca6d0f7f7fd2ea89ff913672518a4eaea8b9","tlsh":"6ca1735925ee312e47d2a0e19149901db37bca3320ad59a1f09d42915f80b7ce3dbfee"}],"package_integrity":[{"filename":"autoprefixers-1.2.0.tgz","hashes":{"sha1":"0a975a9e1b90b7679e86319a15e8a8030ba05ad3","sha512_sri":"sha512-urbK/vDcNufVRp0GuTDeiAjTBzYQTyrQjBB1LbUIVyUZpOskSA1EZ22DYan5hAc1qgwxCnzIcn0GlJTVCa4wwg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ai_/autoprefixers/v/1.2.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ai_/autoprefixers/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@ai_/autoprefixers/v/1.1.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010872","import_time":"2026-07-28T14:19:56.815726801Z","modified_time":"2026-07-28T13:29:56Z","sha256":"5c2804af51ff476ec1ebdcec7b393366a66015ada2d2453a2acfbd21f99890f2","source":"amazon-inspector","versions":["1.2.0"]},{"id":"IN-MAL-2026-014711","import_time":"2026-08-05T13:08:39.844028812Z","modified_time":"2026-08-05T12:34:24Z","sha256":"2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-014710","import_time":"2026-08-05T13:08:39.747281062Z","modified_time":"2026-08-05T12:34:14Z","sha256":"0800faed585dfd95d652a3143e9ef58932f9e632d812666b29787c09ed1c175f","source":"amazon-inspector","versions":["1.1.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}