{"id":"MAL-2026-17804","summary":"Malicious code in css-nesting-transform (npm)","details":"css-nesting-transform@1.0.0 was published to npm on 2026-10-07 01:32 UTC by user brahimhamidi (the same account that published css-flow-render-shim@1.0.0 on 2026-10-06). It is described as a CSS polyfill but contains none: index.js is an empty module (byte-identical to the index.js of css-jptvix-polyfill@1.0.0) and payload.min.css is 29 bytes. payload.bundle.min.js carries the payload and runs at require time as a top-level IIFE; it first deletes its own require.cache entries so that it runs again on every require. Module names, commands and URLs are encoded as numeric arrays and decoded at runtime.\n\nBehavior: (1) obtains child_process to execute system commands; (2) runs whoami, id and uname -a with execSync and sends each output, together with os.hostname() and the tag vector=registryLibrariesTopology, to https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418 through both fetch and https.get; (3) sends a beacon tagged topology-rce-v7 with the Node version, platform, process id and timestamp; (4) exports Proxy objects under Wix-internal module names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, autoCompleteRegistry, thunderboltBuilderRegistry, thunderboltPreviewRegistry), and the two rb_*.thunderbolt.manifest.min.json files list the payload under https://unpkg.com/css-nesting-transform@1.0.0/, which indicates a dependency-confusion attempt against that organization's private packages.\n\nTrigger: on import (require). Type: information stealer (host and user identity). Same collector path as wix-ssr-thunderbolt-grid-polyfill@0.1.0 (published 2026-10-06 20:21 UTC by user hissakdx92), which performs port scanning and host reconnaissance for the same target, and same payload family as css-flow-render-shim@1.0.0, css-jptvix-polyfill@1.0.0 and css-eqxcdx-polyfill.","modified":"2026-10-12T04:45:05.841910541Z","published":"2026-10-08T06:00:00Z","database_specific":{"iocs":{"urls":["https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418"],"domains":["webhook.site"],"files":[{"source":"PACKAGE_ARCHIVE","digests":{"sha256":"225cc9416e39883c2390e604d2ef10cbde572f909d52abf3ddc2361b220f6a18"},"note":"payload: runs on require, executes whoami, id and uname -a and sends the output to webhook.site","paths":["payload.bundle.min.js"]},{"paths":["rb_wixui.thunderbolt.manifest.min.json"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"6452b9044a064b07500e758cf348f72d20b65429a020ab0d01dc15c0230240c9"},"note":"manifest in Wix thunderbolt format pointing at this package on unpkg (dependency confusion)"}]}},"affected":[{"package":{"name":"css-nesting-transform","ecosystem":"npm","purl":"pkg:npm/css-nesting-transform"},"versions":["1.0.0"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/css-nesting-transform/MAL-2026-17804.json"}}],"schema_version":"1.9.0","credits":[{"name":"Eunsoo Kim","contact":["https://github.com/eskim86"],"type":"FINDER"}]}