ac-polyfills

{"schema_version":"1.7.4","id":"MAL-2026-782","published":"2026-02-06T02:07:02Z","modified":"2026-09-21T05:20:59.085504133Z","summary":"Malicious code in ac-polyfills (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (98dfac851a08e8e8967e1386dadfd513226414b0ed65f6479a914479eb903878)\nac-polyfills@2.10.0 declares a preinstall lifecycle script in package.json (line 7-8) that runs `wget` to a hardcoded webhook.site collector URL (https://webhook.site/381d4406-8f87-4aab-961f-7a9496c21821/), sending the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as query parameters. This fires automatically on `npm install` with no user interaction, exfiltrating installer identity and host information to a third-party webhook collector. The package name and shape are consistent with a dependency-confusion probe targeting an internal package name.\n\n## Source: ossf-package-analysis (c374cffaf0245c256691284c7b1c5dbeb5202f8d633efe3d23bc46c5c08806a9)\nThe OpenSSF Package Analysis project identified 'ac-polyfills' @ 2.10.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"name":"ac-polyfills","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["99.9.9","2.10.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"8c3dd253390bc47977519727afd6210fbebfb881f08387ec672899cfb33fa3c3","tlsh":"8a010234a330bb731ac256b204bd873fb531fba791156c0dafab221ad35ede200b9515"}],"package_integrity":[{"filename":"ac-polyfills-2.10.0.tgz","hashes":{"sha1":"654356a88d7e44ae90799eee1025f3219831a98b","sha512_sri":"sha512-FTRwek4ZiQbzBe1kqZ0+rN3F4M/VCarYnS0NWA/IUaAfarVBDYOkJpF8erLXaFYIdaU0FYq0FQU9bzxaUuiQJw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ac-polyfills/v/2.10.0"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-02-06T03:03:38.130497165Z","modified_time":"2026-02-06T02:07:02Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"0a7d9d049932519bded5d12b8627523ef63dac69179b1ce873cf4cd8b7fe6849","source":"amazon-inspector"},{"id":"RLMA-2026-01092","import_time":"2026-03-19T12:18:32.051171561Z","modified_time":"2026-03-18T12:37:36Z","sha256":"90cff5e7a441b510af31deb23e35a368e629b0b7bec79e1afa01d9fc37c935b7","source":"reversing-labs","versions":["99.9.9"]},{"id":"IN-MAL-2026-020180","import_time":"2026-09-18T05:39:51.317096608Z","modified_time":"2026-09-18T05:25:24Z","sha256":"98dfac851a08e8e8967e1386dadfd513226414b0ed65f6479a914479eb903878","source":"amazon-inspector","versions":["2.10.0"]},{"import_time":"2026-09-21T05:19:22.44602724Z","modified_time":"2026-09-17T23:15:53Z","sha256":"c374cffaf0245c256691284c7b1c5dbeb5202f8d633efe3d23bc46c5c08806a9","source":"ossf-package-analysis","versions":["2.10.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com","inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"},{"name":"ReversingLabs","contact":["https://www.reversinglabs.com"],"type":"FINDER"}]}