Malicious code in ac-polyfills (npm)

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (98dfac851a08e8e8967e1386dadfd513226414b0ed65f6479a914479eb903878) [email protected] declares a preinstall lifecycle script in package.json (line 7-8) that runs `wget` to a hardcoded webhook.site collector URL (https://webhook.site/381d4406-8f87-4aab-961f-7a9496c21821/), sending the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as query parameters. This fires automatically on `npm install` with no user interaction, exfiltrating installer identity and host information to a third-party webhook collector. The package name and shape are consistent with a dependency-confusion probe targeting an internal package name. ## Source: ossf-package-analysis (c374cffaf0245c256691284c7b1c5dbeb5202f8d633efe3d23bc46c5c08806a9) The OpenSSF Package Analysis project identified 'ac-polyfills' @ 2.10.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

Source published

6 Feb 2026 02:07:02 UTC

Source modified

21 Sep 2026 05:30:06 UTC

Saved here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.