popover-anchor-polyfill is malicious. Its code runs at install and can read the secrets of the machine.
npm ↗Details
- You run
- not in lockfile
- Safe
- no fixed version
- Advisories
- 1 in 120 days
Alerts(1)
Conditions not read yet
Source summary
Source: amazon-inspector (31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9) The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that spawns shell commands via child process.execSync ( id , whoami , uname -a , ifconfig / ip addr ) and reads /etc/hosts , then transmits each command's output together with hostname, Node version, platform, and pid over plain HTTP GET requests to the hardcoded endpoint http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. The require path uses ca
- Affected
- popover-anchor-polyfill 1.0.0
- Fixed in
- no fix yet
- ID
- GHSA-254v-2947-w7m9