{"id":"MAL-2026-17518","summary":"Malicious code in postcss-gap-fallback-util (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5b54d5bd893bc377a77503059998e01ae3e338fd4d8ddac6fe2d7c71a3157cb5)\nThe package is published as a PostCSS gap fallback utility but ships thunderboltRegistry.js, which executes an IIFE on module load. The IIFE runs whoami, id, and hostname via child_process.execSync, curls the AWS instance metadata service at http://169.254.169.254/latest/meta-data/ for IAM role, instance-id, availability zone, and local IPv4, and sends the results to https://webhook.site/0492a36c-4d7b-408a-865c-226db25987ba along with DNS beacons to a host under oast.live. A registry-manifest.min.json maps multiple Wix-internal registry names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, thunderboltBuilderRegistry, thunderboltPreviewRegistry) to the same exfiltration file, and the module exports a Proxy returning no-op registry methods as a façade. The naming, manifest, and façade indicate a dependency-confusion payload targeting Wix build infrastructure; on any installer that requires one of the impersonated module names, shell identity, hostname, and (on EC2) AWS IAM role credentials/metadata are leaked to an attacker-controlled webhook and DNS collector.\n","modified":"2026-10-04T23:45:20.818383634Z","published":"2026-10-04T23:26:45Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020962","import_time":"2026-10-04T23:40:46.271402856Z","modified_time":"2026-10-04T23:26:45Z","sha256":"5b54d5bd893bc377a77503059998e01ae3e338fd4d8ddac6fe2d7c71a3157cb5","source":"amazon-inspector","versions":["1.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/postcss-gap-fallback-util/v/1.0.0"}],"affected":[{"package":{"name":"postcss-gap-fallback-util","ecosystem":"npm","purl":"pkg:npm/postcss-gap-fallback-util"},"versions":["1.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/postcss-gap-fallback-util/MAL-2026-17518.json","indicators":{"evidence_files":[{"sha256":"8e566b606b643230d0e0d83ba77eb2ed206f1850c33737ebc005e1816e1aa51f","tlsh":"45a1117af656b0716e83b0789f7f610de07b9a432ca8abd0b8190db00f25559017a6f9","path":"thunderboltRegistry.js"},{"sha256":"cec86678845ca0b46112ce8e9ec65d92faedf5ad8e25e6dcf7277009fc815f29","tlsh":"ff119e9d0d03116b0fd0aa4fa40beb4ade0209460deed1a2755593b539251d513ea76b","path":"registry-manifest.min.json"}],"package_integrity":[{"hashes":{"sha1":"f760968c158d679c4cea323cec0fce43d95653c4","sha512_sri":"sha512-9/0VY4uCdT8K1A0n5tC27Gft5sWrHXji0D3UoqMUAgib5r6oBdSlesfu+rPyKp30TtPSErfmjLzFy8y1yQCvLQ=="},"filename":"postcss-gap-fallback-util-1.0.0.tgz"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}