Logo
npm

css-grid-snap-util@1.0.1

Vulnerability report · Last retrieved from osv.dev October 29, 2026 at 4:00 PM UTC

Malicious

OSV ID

MAL-2026-18313

Ecosystem

npm

Summary

css-grid-snap-util@1.0.1 ships a stub index.js that returns a static object and declares no install lifecycle hooks. The tarball additionally includes a JSON manifest containing a baseURL field pointing at a webhook.site unique collector endpoint (https://webhook.site/633e0d27-3407-4b73-a242-1ecd1f6edcb8/bundles/). No code in the package reads this file, transmits data, or fetches remote content, so installing or requiring the package does not currently execute any outbound behavior. The combination of a thin stub module, an unused manifest referencing a known beacon host, and a generic name reminiscent of internal utility packages fits the shape of a dependency-confusion placeholder or proof-of-concept rather than a functional library.

Source: amazon-inspector (62b283b75dfc6a5bc055d778b3c5855b75f1f80e95639420cabeb24f8440ec42)

Protect your entire dependency tree

Scan your lock files automatically on every PR. Block malicious packages before they reach production.