Malicious code in web-vitals-polyfill-core-v1 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (38311c0f483e9485a7b5e8aa7f9a093a40203d8e1a025c0bf5850c2874cffdfa) The package name mimics the widely-used web-vitals polyfill but the tarball ships disk/index.min.js, a base64-wrapped service-worker payload (self.__PWA_ROUTER__.executeTacticalRouting) that resolves an active destination via DoH TXT lookups of api.chinazhangsan.ccwu.cc (queried through doh.pub and dns.alidns.com) with base64-encoded fallback endpoints on gist.githubusercontent.com/chinazhangsan999-crypto and api.npoint.io, performs decoy fetches, and issues Response.redirect(targetUrl, 302) to the resolved host. package.json declares main: index.js which is not present in the tarball, so the package has no legitimate library surface; its shipped code is exclusively the obfuscated redirector, intended to be loaded into a consuming site's service worker where it can hijack end-user navigation to attacker-chosen destinations resolved at runtime through multi-provider DNS-over-HTTPS and paste-site fallbacks. ## Source: ghsa-malware (583291fe7133304271006d1ca425c04aebce7279be07963310434403dfc19319) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that r
MAL-2026-17303
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17303
web-vitals-polyfill-core-v1
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "web-vitals-polyfill-core-v1",
"purl": "pkg:npm/web-vitals-polyfill-core-v1",
"ecosystem": "npm"
},
"versions": [
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/web-vitals-polyfill-core-v1/MAL-2026-17303.json",
"indicators": {
"evidence_files": [
{
"path": "disk/index.min.js",
"tlsh": "e391e796cec72e94d7f8815b35ec7eee0c8e538b3ce3699e525be5d9600940141c58f4",
"sha256": "76ec2b68807c6ef7ae1e93dbc31b21d0ab1fa8ea865719a9b8b85f1bdb295dfe"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "eed8f8e6cb0ca54e780186b679a466ac774d156d",
"sha512_sri": "sha512-+cAO6H59vIT9kOsrXQIoYfR+/KPW3TrSC1AaYkkl+P/hGwsnf8/X6FrzegHqsdxWNPdkwe5nlF/ZPkVt6UBQqQ=="
},
"filename": "web-vitals-polyfill-core-v1-1.0.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #37016 · Revision 1
- Added to Heist Feed
- Publisher date