Anchor: real package clean. 3 lookalike flagged.
Last 30 days
Safe versions
No fixed version published.
Your project
@anchor-lang/core is not in your saved lockfile.
Alerts(3)
Sorted by severitySource summary
Source: amazon-inspector (bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05) The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id , whoami , uname -a , ifconfig / ip addr , and reads /etc/hosts , then POSTs the collected output along with hostname, platform, and Node version via fetch to the hardcoded external endpoint http://dxpoc.gt.tc/callback.php/. The module also exports keys named after Wix thunderbolt internal registries (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, e
- Affected
- css-anchor-pos-fallback 1.0.0
- Fixed in
- no fix yet
- ID
- GHSA-4ppq-v2jm-24mc
Source summary
Source: amazon-inspector (36596ba9b9d8c0f994abe3cd87783f4f0dc880e63d55374d3555347ce349fab2) Package is published as css-scroll-anchor-polyfill but its index.js is empty and its contents impersonate internal Wix thunderbolt registry module names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, and others) with a shipped registry-manifest.min.json mapping them to parastorage.com URLs. The declared purpose (a CSS scroll-anchor polyfill) is unrelated to the shipped code. thunderboltRegistry.js contains a top-level IIFE that executes on require:
- Affected
- css-scroll-anchor-polyfill 1.0.0
- Fixed in
- no fix yet
- ID
- GHSA-wqfg-33rw-c9rw
Source summary
Source: amazon-inspector (31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9) The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that spawns shell commands via child process.execSync ( id , whoami , uname -a , ifconfig / ip addr ) and reads /etc/hosts , then transmits each command's output together with hostname, Node version, platform, and pid over plain HTTP GET requests to the hardcoded endpoint http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. The require path uses ca
- Affected
- popover-anchor-polyfill 1.0.0
- Fixed in
- no fix yet
- ID
- GHSA-254v-2947-w7m9