MAL-2026-17514

    Dashboard / Malicious Package / MAL-2026-17514

    MAL-2026-17514

    Published: 4 Oct 2026Last Modified: 4 Oct 2026

    Summary: Malicious code in minimal-a11y-contrast-check (npm)

    Details: Source: amazon-inspector (d9a198e6fb2c5e31bc841ff12f210e630abe8629853faf4ea961a124a9be8a25) Despite being advertised as a WCAG contrast checker, the package executes a self-invoking function at module load that runs host reconnaissance commands (whoami, id, hostname, uname -a, ls -la /, pwd, cat /etc/os-release) and collects filtered environment variables, then exfiltrates the results via DNS subdomain requests to davdpb8lhot13kgmnhp0863x9g83mpswq.oast.live and HTTP GET parameters to webhook.site/0492a36c-4d7b-408a-865c-226db25987ba. The exfiltration fires on any import of the package. Additionally, the module exports factories named after Wix Thunderbolt internal registries (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry) and ships a registry-manifest.min.json pointing at static.parastorage.com/unpkg/[email protected], impersonating internal Wix build infrastructure to be resolved via dependency confusion. A hardcoded 'internetbrands' tag embedded in the exfiltration payload indicates targeted reconnaissance.

    References: https://www.npmjs.com/package/minimal-a11y-contrast-check/v/1.0.0

    Affected packages

    Package

    Name: minimal-a11y-contrast-check

    Purl: pkg:npm/minimal-a11y-contrast-check

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0