MAL-2026-17528

    Dashboard / Malicious Package / MAL-2026-17528

    MAL-2026-17528

    Published: 4 Oct 2026Last Modified: 4 Oct 2026

    Summary: Malicious code in tiny-viewport-unit-calc (npm)

    Details: Source: amazon-inspector (34c221d8f8f0fedded27bfc22763912ffd96e9f3d1b2c08932e054ed418f493e) The package ships thunderboltRegistry.js, a module that imports Node's child_process primitives and executes `whoami` plus repeated `ping` commands against external hostnames, with POST calls present in the same file. The pattern (whoami capture + repeated ping-based beacons + outbound POSTs) is host-reconnaissance and DNS/ICMP-channel exfiltration shape, directed from the installer's machine to an external endpoint. The behavior is unrelated to the package's advertised purpose (a trivial viewport-unit calculator) and provides no functionality to a consumer; its only effect is to leak host identity information off-host when the module is loaded or invoked.

    References: https://www.npmjs.com/package/tiny-viewport-unit-calc/v/1.0.0

    Affected packages

    Package

    Name: tiny-viewport-unit-calc

    Purl: pkg:npm/tiny-viewport-unit-calc

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0