MAL-2026-782
Malicious code in ac-polyfills (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (98dfac851a08e8e8967e1386dadfd513226414b0ed65f6479a914479eb903878) ac-polyfills@2.10.0 declares a preinstall lifecycle script in package.json (line 7-8) that runs `wget` to a hardcoded webhook.site collector URL (https://webhook.site/381d4406-8f87-4aab-961f-7a9496c21821/), sending the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as query parameters. This fires automatically on `npm install` with no user interaction, exfiltrating installer identity and host information to a third-party webhook collector. The package name and shape are consistent with a dependency-confusion probe targeting an internal package name.
Are you affected?
Enter the version of the package you're using.
Affected packages
0No fixed version published yet for ac-polyfills (npm). Pin to a known-safe version or switch to an alternative.