MAL-2026-17517

    Dashboard / Malicious Package / MAL-2026-17517

    MAL-2026-17517

    Published: 4 Oct 2026Last Modified: 4 Oct 2026

    Summary: Malicious code in popover-anchor-polyfill (npm)

    Details: Source: amazon-inspector (31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9) The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that spawns shell commands via child_process.execSync (`id`, `whoami`, `uname -a`, `ifconfig`/`ip addr`) and reads `/etc/hosts`, then transmits each command's output together with hostname, Node version, platform, and pid over plain HTTP GET requests to the hardcoded endpoint http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. The require path uses cache-bypass tricks (deleting require.cache entries matching 'thunderboltRegistry' and manually constructing a fresh Module to re-resolve child_process) to defeat mocking or interception. Sibling stub files and a `registry-manifest.min.json` impersonate Wix thunderbolt internal registry names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry) and reference static.parastorage.com, indicating a dependency-confusion lure targeting Wix build pipelines. The declared polyfill purpose does not match the shipped Wix-internal namespace exports, and no popover-polyfill functionality is implemented.

    References: https://www.npmjs.com/package/popover-anchor-polyfill/v/1.0.0

    Affected packages

    Package

    Name: popover-anchor-polyfill

    Purl: pkg:npm/popover-anchor-polyfill

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0