MAL-2026-17501

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/a11y-tabindex-manager/MAL-2026-17501.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17501
Published
2026-10-04T23:28:48Z
Modified
2026-10-04T23:45:16Z
Summary
Malicious code in a11y-tabindex-manager (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ce127c3e1cadd4f544a5f2580f2db030e3d9e3667d7b0e3399d85b59eb354045)

a11y-tabindex-manager ships thunderboltRegistry.js, which executes an IIFE on module load that runs a series of local shell commands (cat /etc/hosts, whoami, id, pwd, ifconfig/ip addr, hostname, cat /etc/resolv.conf, uname -a, env | head -50) via child_process.execSync and POSTs each output over plain HTTP to the hardcoded endpoint http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. A separate beacon labeled 'rce-poc-v3' sends Node.js version, platform, and PID to the same host. child_process is acquired both directly and via a fallback that instantiates a new Module (new module.constructor()) and copies module.paths — an evasion technique to bypass simple require('child_process') scans. The package name resembles a generic accessibility helper, but the shipped registry entry performs host identity, network configuration, user, and environment-variable harvesting with no legitimate purpose.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020976",
            "import_time":  "2026-10-04T23:40:47.6682475Z",
            "modified_time":  "2026-10-04T23:28:48Z",
            "sha256":  "ce127c3e1cadd4f544a5f2580f2db030e3d9e3667d7b0e3399d85b59eb354045",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / a11y-tabindex-manager

Package

Name
a11y-tabindex-manager
View open source insights on deps.dev
Purl
pkg:npm/a11y-tabindex-manager

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "thunderboltRegistry.js",
            "sha256":  "a53862650d7a1ab9a06205c979ee666b010c8bca97a666ed1a2ab0fa256f8d32",
            "tlsh":  "858150a1f95df030a9c37838cb7f504aa4bb96672c2ceee474495ab01f39558017e5f4"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "a11y-tabindex-manager-1.0.0.tgz",
            "hashes":  {
                "sha1":  "ca82fec412f83afdf436bdd7221fcf3c7803683f",
                "sha512_sri":  "sha512-ZR7Xx6CB6VafX1k2Mi7W+vPlKyqQMLs/jp+0zbkRS1vdaj6QlVjceewxD50PjT+qbUELJDTiloGWVOCeJrf9oA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/a11y-tabindex-manager/MAL-2026-17501.json"