{"items":[{"id":"NVI-00011061","kind":"supply_chain_event","title":"Malicious code in wcag-color-a11y-helpers (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-hp8q-m388-6xxg"],"plain_summary":"GitHub lists this malware advisory for wcag-color-a11y-helpers. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-afcdfc706b0d1fcd05db2c409c8a5bb3"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-afcdfc706b0d1fcd05db2c409c8a5bb3","url":"https://github.com/advisories/GHSA-hp8q-m388-6xxg","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-hp8q-m388-6xxg","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:05.881Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-afcdfc706b0d1fcd05db2c409c8a5bb3"],"technology":"wcag-color-a11y-helpers","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (8b6e72298f32298d6558f5d52eb7a9d5185b37fe8df14748bf61d6686dde1cb3)\nPackage is advertised as a WCAG color accessibility helper library but ships thunderboltRegistry.js, an IIFE that on module load executes shell commands (whoami, id, pwd, ifconfig/ip addr, hostname) and transmits the output via HTTP GET and DNS subdomain lookups to the hardcoded Burp Collaborator host gzjsunzfc6i9od2ouhb6dl4a61cs0qof.oastify.com, along with node/platform/pid metadata and an 'rce-poc' beacon string. The package exports factory functions under names mirroring Wix Thunderbolt internal registries (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, autoCompleteRegistry, thunderboltBuilderRegistry, thunderboltPreviewRegistry), and ships a registry-manifest.min.json that maps all of those registry names to thunderboltRegistry.js — a dependency-confusion/typosquat shape against Wix's @wix/thunderbolt-* internal registries. Any consumer that resolves one of these names loads and executes the recon/exfiltration payload. The a11y naming is a cover story unrelated to the actual code.\n\n---\n\nCredit: [OpenSSF](https://github.com/ossf/malicious-","public_affected_ranges":["= 1.0.0"]}],"null_published_at":"2026-10-31T23:18:22.428Z","source_updated_at":"2026-10-05T00:30:47.000Z","source_disclosed_at":"2026-10-05T00:30:38.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:05.881Z"}],"next_cursor":null,"snapshot_revision":"42594"}