MAL-2026-17530

    Dashboard / Malicious Package / MAL-2026-17530

    MAL-2026-17530

    Published: 4 Oct 2026Last Modified: 4 Oct 2026

    Summary: Malicious code in wcag-color-a11y-helpers (npm)

    Details: Source: amazon-inspector (8b6e72298f32298d6558f5d52eb7a9d5185b37fe8df14748bf61d6686dde1cb3) Package is advertised as a WCAG color accessibility helper library but ships thunderboltRegistry.js, an IIFE that on module load executes shell commands (whoami, id, pwd, ifconfig/ip addr, hostname) and transmits the output via HTTP GET and DNS subdomain lookups to the hardcoded Burp Collaborator host gzjsunzfc6i9od2ouhb6dl4a61cs0qof.oastify.com, along with node/platform/pid metadata and an 'rce-poc' beacon string. The package exports factory functions under names mirroring Wix Thunderbolt internal registries (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, autoCompleteRegistry, thunderboltBuilderRegistry, thunderboltPreviewRegistry), and ships a registry-manifest.min.json that maps all of those registry names to thunderboltRegistry.js — a dependency-confusion/typosquat shape against Wix's @wix/thunderbolt-* internal registries. Any consumer that resolves one of these names loads and executes the recon/exfiltration payload. The a11y naming is a cover story unrelated to the actual code.

    References: https://www.npmjs.com/package/wcag-color-a11y-helpers/v/1.0.0

    Affected packages

    Package

    Name: wcag-color-a11y-helpers

    Purl: pkg:npm/wcag-color-a11y-helpers

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0