Malicious code in aria-live-region-helper (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (391a9a163273e36e3945f918ea720b8e10aa462b0aa603d4012b28c557c58570) The package is advertised as an ARIA accessibility helper but ships thunderboltRegistry.js, which executes a top-level IIFE on module load. The IIFE runs shell reconnaissance commands via child_process.execSync (whoami, id, pwd, ifconfig/ip addr, cat /etc/hosts, hostname) and sends their output, together with a beacon containing Node version, process.platform, and PID, via HTTP GET requests to the hardcoded endpoint http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. The package also exports factories under names matching internal Wix thunderbolt registry entry points (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, etc.) and includes a registry-manifest.min.json mapping those names to parastorage.com unpkg URLs, so that a build pipeline resolving any of those registry names to this package triggers the recon-exfiltration side effect on import. Neither the reconnaissance behavior nor the dxpoc.gt.tc destination is related to the package's advertised accessibility purpose.
MAL-2026-17546
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17546
aria-live-region-helper
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "aria-live-region-helper",
"purl": "pkg:npm/aria-live-region-helper",
"ecosystem": "npm"
},
"versions": [
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/aria-live-region-helper/MAL-2026-17546.json",
"indicators": {
"evidence_files": [
{
"path": "thunderboltRegistry.js",
"tlsh": "4f7143a5b99df02196c37438cf7f904ea4bb86672c2caee4744859b01f3945c01ba5f4",
"sha256": "c5823a5b4efa046453d6cc532602f7dd9efa1c7a35fc5585cfcab17bcef75cbd"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "9f3f7368c542eb55fbc0febc99ab929045575198",
"sha512_sri": "sha512-Pf8LW3EPyNs+i6jwfgbCFNAxZXFAoJ4cV2zsctl34sg32M5sfZjWDWRWiu0wh7um5QoUqjWvwKLBamLNig7kjg=="
},
"filename": "aria-live-region-helper-1.0.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #83606 · Revision 1
- Added to Heist Feed
- Publisher date