{"id":"MAL-2026-17481","revision":"cc92c8b152114499bb4bbd55f97aa012","records":[{"revision":"cc92c8b152114499bb4bbd55f97aa012","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17481","aliases":[],"title":"Malicious code in css-light-dark-polyfill (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (856c154d7855924568c88181f172f46e84aac202bd6cb29974eb2ffaa3ec3ea7)\nThe package presents itself as a trivial CSS polyfill (index.js exports an empty object) but ships thunderboltRegistry.js, which on load runs a self-invoking IIFE that collects host identifiers (os.hostname, node version, platform, pid) and the output of local shell commands (id, whoami, uname -a, ifconfig/ip addr, /etc/hosts via child_process.execSync) and POSTs each result via fetch() to the hardcoded endpoint https://dxpoc.gt.tc/callback.php/. The payload self-labels as 'beacon=rce-poc'. The package also exports factories under the names of internal Wix Thunderbolt build registries (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, etc.), and a bundled registry-manifest.min.json maps those names to parastorage.com URLs — a dependency-confusion shape targeting Wix-like build systems that resolve these internal registry module names. Installing or loading this package causes host reconnaissance data to be exfiltrated to an attacker-controlled domain unrelated to any CSS polyfill functionality.\n","state":0,"publishedAt":"2026-10-04T23:14:43+00:00","modifiedAt":"2026-10-04T23:30:05.6467392+00:00","affected":[{"ecosystem":"npm","name":"css-light-dark-polyfill","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/css-light-dark-polyfill/v/1.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17481","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17481","identifiers":["MAL-2026-17481"]},"retained":false,"historicalAffected":[]}],"coverage":[]}