MAL-2026-11120
Malicious code in @ai_/autoprefixers (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (5c2804af51ff476ec1ebdcec7b393366a66015ada2d2453a2acfbd21f99890f2) @ai_/autoprefixers is a typosquat of the popular autoprefixer package. On require, lib/autoprefixer.js loads node:child_process via a base64-hidden string (`bm9kZTpjaGlsZF9wcm9jZXNz`), fetches AES-256-CBC ciphertext over plain HTTP from http://player.sweeprovider.org/getKey.php and a key from http://player.sweeprovider.org/generateRandomKey.php, decrypts them using a helper (`utils.prefixInfo`) with a hardcoded key suffix `47e01aba1e12cf6d`, and passes the plaintext to child_process.exec (also base64-hidden as `ZXhlYw==`). Any consumer that installs and imports this package receives arbitrary attacker-controlled shell command execution on their machine, with the C2 endpoint free to change the delivered payload at any time.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for @ai_/autoprefixers (npm). Pin to a known-safe version or switch to an alternative.