css-grid-snap-util@1.0.1
Vulnerability report · Last retrieved from osv.dev October 29, 2026 at 4:00 PM UTC
OSV ID
MAL-2026-18313
Ecosystem
npm
Summary
css-grid-snap-util@1.0.1 ships a stub index.js that returns a static object and declares no install lifecycle hooks. The tarball additionally includes a JSON manifest containing a baseURL field pointing at a webhook.site unique collector endpoint (https://webhook.site/633e0d27-3407-4b73-a242-1ecd1f6edcb8/bundles/). No code in the package reads this file, transmits data, or fetches remote content, so installing or requiring the package does not currently execute any outbound behavior. The combination of a thin stub module, an unused manifest referencing a known beacon host, and a generic name reminiscent of internal utility packages fits the shape of a dependency-confusion placeholder or proof-of-concept rather than a functional library.
Source: amazon-inspector (62b283b75dfc6a5bc055d778b3c5855b75f1f80e95639420cabeb24f8440ec42)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.