{"items":[{"id":"NVI-00012239","kind":"supply_chain_event","title":"Malicious code in analytics-widget (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xpv4-prm5-w6gr"],"plain_summary":"GitHub lists this malware advisory for analytics-widget, analytics-widget. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0b629fdea32a5ec97658c6636e0af702"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0b629fdea32a5ec97658c6636e0af702","url":"https://github.com/advisories/GHSA-xpv4-prm5-w6gr","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xpv4-prm5-w6gr","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:59:09.082Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0b629fdea32a5ec97658c6636e0af702"],"technology":"analytics-widget","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (4b78f3ed716380da74c5d54de6e24b6b128536a7ce5772e8b05d03108a1d9b74)\nThe package is published as 'analytics-widget' with an empty description, but its main module contains no analytics functionality. On load, index.js schedules a 2-second timer that reads the 'token' key from browser localStorage, falls back to a JSON serialization of the entire localStorage store if that key is missing, and POSTs the result to the relative endpoint '/addPost' via fetch. When bundled into a consumer's frontend, every end-user session that loads the page has their auth token (or the full localStorage contents) sent to whichever origin serves the bundle, enabling session hijacking of the consuming application's users. The package name and empty metadata serve as a cover story; no legitimate analytics code is present.\n\n---\n\nCredit: OpenSSF (source)","public_affected_ranges":["= 1.0.0"]},{"certainty":"source_listed","source_ids":["sr-0b629fdea32a5ec97658c6636e0af702"],"technology":"analytics-widget","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (4b78f3ed716380da74c5d54de6e24b6b128536a7ce5772e8b05d03108a1d9b74)\nThe package is published as 'analytics-widget' with an empty description, but its main module contains no analytics functionality. On load, index.js schedules a 2-second timer that reads the 'token' key from browser localStorage, falls back to a JSON serialization of the entire localStorage store if that key is missing, and POSTs the result to the relative endpoint '/addPost' via fetch. When bundled into a consumer's frontend, every end-user session that loads the page has their auth token (or the full localStorage contents) sent to whichever origin serves the bundle, enabling session hijacking of the consuming application's users. The package name and empty metadata serve as a cover story; no legitimate analytics code is present.\n\n---\n\nCredit: OpenSSF (source)","public_affected_ranges":["= 1.0.1"]}],"null_published_at":"2026-11-01T01:45:40.747Z","source_updated_at":"2026-09-24T15:31:20.000Z","source_disclosed_at":"2026-09-24T15:31:20.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:59:09.082Z"}],"next_cursor":null,"snapshot_revision":"42594"}