tiny-viewport-unit-calc

GHSA-q9p4-hv94-cxpj

Malicious code in tiny-viewport-unit-calc (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (34c221d8f8f0fedded27bfc22763912ffd96e9f3d1b2c08932e054ed418f493e)
The package ships thunderboltRegistry.js, a module that imports Node's child_process primitives and executes `whoami` plus repeated `ping` commands against external hostnames, with POST calls present in the same file. The pattern (whoami capture + repeated ping-based beacons + outbound POSTs) is host-reconnaissance and DNS/ICMP-channel exfiltration shape, directed from the installer's machine to an external endpoint. The behavior is unrelated to the package's advertised purpose (a trivial viewport-unit calculator) and provides no functionality to a consumer; its only effect is to leak host identity information off-host when the module is loaded or invoked.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/tiny-viewport-unit-calc/MAL-2026-17528.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/tiny-viewport-unit-calc/MAL-2026-17528.json
- https://www.npmjs.com/package/tiny-viewport-unit-calc/v/1.0.0
- https://github.com/advisories/GHSA-q9p4-hv94-cxpj

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.