{"id":"MAL-2026-17655","revision":null,"records":[{"revision":"dd656db9419144bb852e6a338de4229c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17655","aliases":[],"title":"Malicious code in css-flow-render-shim (npm)","description":"css-flow-render-shim@1.0.0 was published to npm on 2026-10-06 22:49 UTC by user brahimhamidi (the account's only package). It is described as a CSS polyfill but contains none: index.js is an empty module (byte-identical to the index.js of css-jptvix-polyfill@1.0.0) and payload.min.css is 15 bytes. payload.bundle.min.js carries the payload and runs at require time as a top-level IIFE; it first deletes its own require.cache entries so that it runs again on every require.\n\nBehavior: (1) obtains child_process through require('child_process'), require('node:child_process') or a freshly constructed Module instance if both are blocked (lines 29-31); (2) runs whoami, id, uname -a, env (first 100 lines, 2,000 characters sent), ifconfig || ip addr, and cat /etc/hosts with execSync and sends each output, together with os.hostname() and the tag vector=registryLibrariesTopology, to https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418 through both fetch and https.get (lines 12-56); the env step exfiltrates the host's environment variables, including any tokens; (3) sends a beacon tagged topology-rce with the Node version, platform, process id and package name (line 60); (4) exports Proxy objects under Wix-internal module names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, autoCompleteRegistry, thunderboltBuilderRegistry, thunderboltPreviewRegistry), and the two rb_*.thunderbolt.manifest.min.json files list the payload under https://unpkg.com/css-flow-render-shim@1.0.0/, which indicates a dependency-confusion attempt against that organization's private packages (lines 65-98).\n\nTrigger: on import (require). Type: information stealer (host identity, network configuration and environment variables). Same collector path as wix-ssr-thunderbolt-grid-polyfill@0.1.0 (published 2026-10-06 20:21 UTC by user hissakdx92), which performs port scanning and host reconnaissance for the same target, and same payload family as css-jptvix-polyfill@1.0.0 and css-eqxcdx-polyfill.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f008c8756b09bb1840b05eafe5a30432475f6cc2d5a10064a42920059e8784fd)\nThe package publishes an empty index.js stub but ships Thunderbolt manifests that register payload.bundle.min.js as the bundle for core Wix components across the thunderbolt/wixui and thunderbolt/dsgnsys namespaces (Container, MasterPage, Section, StylableButton, WRichText, and others), and the bundle exports factories under names like thunderboltRegistry, editorRegistry, and corvidRegistry. When a Wix Thunderbolt build pipeline resolves this name from the public registry instead of the intended internal package, payload.bundle.min.js is loaded and its top-level IIFE executes immediately. The IIFE uses child_process.execSync to run whoami, id, uname -a, env | head -100, ifconfig/ip addr, and cat /etc/hosts, then URL-encodes each output along with hostname, node version, platform, and pid and sends it via https.get to a hardcoded collector at https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418. The payload also iterates require.cache and deletes every entry whose path contains payload, rb_wixui, or rb_dsgnsys so the recon routine re-fires on each subsequent require within a long-running build process. The combination of a hollow public package impersonating an internal Wix shim, Thunderbolt-shaped manifests, host and environment reconnaissance via shell commands, exfiltration to an attacker-controlled webhook.site endpoint, and require.cache tampering is a dependency-confusion attack against Wix build systems.\n","state":0,"publishedAt":"2026-10-08T03:38:22+00:00","modifiedAt":"2026-10-08T22:45:07.3608127+00:00","affected":[{"ecosystem":"npm","name":"css-flow-render-shim","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/css-flow-render-shim/v/1.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17655","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17655","identifiers":["MAL-2026-17655"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T14:21:34.5623772+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T14:21:34.5623772+00:00","lastSuccessAt":"2026-11-10T14:21:34.7231232+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:34.7231242+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-20f5f1620a9c4d3a163610437b9eb63d7be94e16a276e2f8f9cc654892f91ba1","complete":true,"records":421967,"lastAttemptAt":"2026-11-10T14:21:27.5892784+00:00","lastSuccessAt":"2026-11-10T14:21:27.2999239+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:27.5892784+00:00","snapshotPublishedAt":"2026-11-10T13:30:59+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-efc28183efe04e138ba7d91d47b051d0","complete":true,"records":13691,"lastAttemptAt":"2026-11-10T14:22:00.6171939+00:00","lastSuccessAt":"2026-11-10T13:22:39.879+00:00","error":null,"lastVerifiedAt":"2026-11-10T13:22:39.879+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13744,"expectedIdentifiers":13744,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T14:21:34.5623772+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T14:21:34.5623772+00:00","lastSuccessAt":"2026-11-10T14:21:34.7238617+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:34.723862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ceb2be395f4e41c0a351a924227b0d53","complete":false,"records":13697,"lastAttemptAt":"2026-11-10T14:21:59.9529002+00:00","lastSuccessAt":"2026-11-10T14:21:59.949+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T14:21:59.949+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13744,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T14:21:27.8480987+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:27.8480987+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T14:21:27.6400184+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:27.6400184+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-df497239f2f75af38e095cb498791dad4044a8a9a7f5f0ee6008bb732579ab9d","complete":true,"records":3081,"lastAttemptAt":"2026-11-10T14:21:34.5248017+00:00","lastSuccessAt":"2026-11-10T14:21:34.3717399+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:34.5248017+00:00","snapshotPublishedAt":"2026-11-10T14:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-86f40cdda9ca36627f818d0cc8237a8a8c7c22cb687d6747a4ea12bded69e17e","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T14:21:27.7432766+00:00","lastSuccessAt":"2026-11-10T11:25:00.8551311+00:00","error":null,"lastVerifiedAt":"2026-11-10T14:21:27.7432766+00:00","snapshotPublishedAt":"2026-11-10T11:03:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}