tabbables

GHSA-2hg9-6f65-p73j

Malicious code in tabbables (npm)

Details

**Severity:** Critical

**Affected versions:** `= 45.0.0`

## Source: amazon-inspector (2fc629ecaf81d15034bbba33363e63776d106e6f58932e889baa4cb748b689eb)
package.json at line 11 declares a dependency whose key equals the package's own name (`tabbables`) and whose value is the raw HTTPS URL `https://repo.securityctrl.com/tabbables` rather than a registry version range. On `npm install`, npm fetches whatever tarball that URL currently serves and installs it, executing any lifecycle scripts it contains, with no version pin, no integrity/hash check, and no registry provenance. The shipped index.js is an inert stub, so the manifest URL is the sole payload-delivery mechanism; the tarball's behavior can be changed at any time by whoever controls repo.securityctrl.com. The self-referential dependency key also produces a dependency-confusion shape (an implausibly high 45.0.0 version competing with any internal package of the same name).

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/8278ab2bd67eee704962fa11801bbf9da85d4939/osv/malicious/npm/tabbables/MAL-2026-15524.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/8278ab2bd67eee704962fa11801bbf9da85d4939/osv/malicious/npm/tabbables/MAL-2026-15524.json
- https://www.npmjs.com/package/tabbables/v/45.0.0
- https://github.com/advisories/GHSA-2hg9-6f65-p73j

Compromised versions (1)

= 45.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.