web-vitals-polyfill-core-v1

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (38311c0f483e9485a7b5e8aa7f9a093a40203d8e1a025c0bf5850c2874cffdfa)
The package name mimics the widely-used web-vitals polyfill but the tarball ships disk/index.min.js, a base64-wrapped service-worker payload (self.__PWA_ROUTER__.executeTacticalRouting) that resolves an active destination via DoH TXT lookups of api.chinazhangsan.ccwu.cc (queried through doh.pub and dns.alidns.com) with base64-encoded fallback endpoints on gist.githubusercontent.com/chinazhangsan999-crypto and api.npoint.io, performs decoy fetches, and issues Response.redirect(targetUrl, 302) to the resolved host. package.json declares main: index.js which is not present in the tarball, so the package has no legitimate library surface; its shipped code is exclusively the obfuscated redirector, intended to be loaded into a consuming site's service worker where it can hijack end-user navigation to attacker-chosen destinations resolved at runtime through multi-provider DNS-over-HTTPS and paste-site fallbacks.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/d7d3c91983ca43b861eb619ab6d817344dac390b/osv/malicious/npm/web-vitals-polyfill-core-v1/MAL-2026-17303.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/d7d3c91983ca43b861eb619ab6d817344dac390b/osv/malicious/npm/web-vitals-polyfill-core-v1/MAL-2026-17303.json
- https://www.npmjs.com/package/web-vitals-polyfill-core-v1/v/1.0.0
- https://github.com/advisories/GHSA-fx3x-h4mr-m28v

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.