MAL-2026-782 Malicious code in ac-polyfills (npm)

[email protected] declares a preinstall lifecycle script in package.json (line 7-8) that runs wget to a hardcoded webhook.site collector URL (https://webhook.site/381d4406-8f87-4aab-961f-7a9496c21821/), sending the installer's username ($(whoami)), current working directory ($(pwd)), and hostname ($(hostname)) as query parameters. This fires automatically on npm install with no user interaction, exfiltrating installer identity and host information to a third-party webhook collector. The package name and shape are consistent with a dependency-confusion probe targeting an internal package name.

The OpenSSF Package Analysis project identified 'ac-polyfills' @ 2.10.0 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.