MAL-2026-782

    Dashboard / Malicious Package / MAL-2026-782

    MAL-2026-782

    Published: 6 Feb 2026Last Modified: 21 Sept 2026

    Summary: Malicious code in ac-polyfills (npm)

    Details: Source: amazon-inspector (98dfac851a08e8e8967e1386dadfd513226414b0ed65f6479a914479eb903878) [email protected] declares a preinstall lifecycle script in package.json (line 7-8) that runs `wget` to a hardcoded webhook.site collector URL (https://webhook.site/381d4406-8f87-4aab-961f-7a9496c21821/), sending the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as query parameters. This fires automatically on `npm install` with no user interaction, exfiltrating installer identity and host information to a third-party webhook collector. The package name and shape are consistent with a dependency-confusion probe targeting an internal package name. Source: ossf-package-analysis (c374cffaf0245c256691284c7b1c5dbeb5202f8d633efe3d23bc46c5c08806a9) The OpenSSF Package Analysis project identified 'ac-polyfills' @ 2.10.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

    References: https://www.npmjs.com/package/ac-polyfills/v/2.10.0

    Affected packages

    Package

    Name: ac-polyfills

    Purl: pkg:npm/ac-polyfills

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    99.9.9
    MAL-2026-782 | CVE-DB