a11y-tabindex-manager

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (ce127c3e1cadd4f544a5f2580f2db030e3d9e3667d7b0e3399d85b59eb354045)
a11y-tabindex-manager ships thunderboltRegistry.js, which executes an IIFE on module load that runs a series of local shell commands (cat /etc/hosts, whoami, id, pwd, ifconfig/ip addr, hostname, cat /etc/resolv.conf, uname -a, env | head -50) via child_process.execSync and POSTs each output over plain HTTP to the hardcoded endpoint http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. A separate beacon labeled 'rce-poc-v3' sends Node.js version, platform, and PID to the same host. child_process is acquired both directly and via a fallback that instantiates a new Module (new module.constructor()) and copies module.paths — an evasion technique to bypass simple require('child_process') scans. The package name resembles a generic accessibility helper, but the shipped registry entry performs host identity, network configuration, user, and environment-variable harvesting with no legitimate purpose.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/a11y-tabindex-manager/MAL-2026-17501.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/a11y-tabindex-manager/MAL-2026-17501.json
- https://www.npmjs.com/package/a11y-tabindex-manager/v/1.0.0
- https://github.com/advisories/GHSA-6rjc-7w2v-h9mg

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.