{"id":"MAL-2026-17547","summary":"Malicious code in css-at-scope-polyfill (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c4d8d974b7fabf04fa662971cd8041fb76775bf5ed2902cbbffed0f881e2036d)\nPackage is published under a CSS-polyfill name but ships thunderboltRegistry.js, which exports Wix internal registry module names (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, etc.) so that a build resolving any of those names will load this file. On require(), an IIFE runs child_process.execSync to collect `id`, `whoami`, `uname`, `ifconfig`/`ip addr`, and the contents of /etc/hosts, plus a beacon containing node version, platform, pid, and hostname, and POSTs the output via fetch to the hardcoded HTTP endpoint http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f. The payload clears any require.cache entries referencing 'thunderboltRegistry' and acquires child_process through three fallbacks, including instantiating a new Module via module.constructor to bypass mocks or sandboxes. The declared CSS-polyfill purpose has no relation to this behavior; the shape is a dependency-confusion squat against internal Wix modules.\n","modified":"2026-10-05T04:15:05.200124888Z","published":"2026-10-05T03:37:15Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-10-05T03:37:15Z","sha256":"c4d8d974b7fabf04fa662971cd8041fb76775bf5ed2902cbbffed0f881e2036d","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-021024","import_time":"2026-10-05T03:57:39.597500531Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/css-at-scope-polyfill/v/1.0.0"}],"affected":[{"package":{"name":"css-at-scope-polyfill","ecosystem":"npm","purl":"pkg:npm/css-at-scope-polyfill"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"path":"thunderboltRegistry.js","sha256":"a485cb48081ea590cab385a405886cfe6f30af7d415f30bc8d7937ace461b928","tlsh":"e87154a5b99df02065c33438cb7f4049b4bbc6672d6caee0744899b01f7985c01be6f8"}],"package_integrity":[{"filename":"css-at-scope-polyfill-1.0.0.tgz","hashes":{"sha512_sri":"sha512-gJRIBJ4jedfAMCc6/qOOoDOgtnSKR459y9B9QJKzPAUVDoAEhaFopx46jHmwCKBpXSeiKwodBEKGry8zkiyy4A==","sha1":"5e679fcafebeb0bafea3ce347f5925a124661831"}}]},"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/css-at-scope-polyfill/MAL-2026-17547.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}