{"id":"MAL-2026-17804","revision":"318311404ac54e9bbd4bc65efc363fe0","records":[{"revision":"318311404ac54e9bbd4bc65efc363fe0","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17804","aliases":[],"title":"Malicious code in css-nesting-transform (npm)","description":"css-nesting-transform@1.0.0 was published to npm on 2026-10-07 01:32 UTC by user brahimhamidi (the same account that published css-flow-render-shim@1.0.0 on 2026-10-06). It is described as a CSS polyfill but contains none: index.js is an empty module (byte-identical to the index.js of css-jptvix-polyfill@1.0.0) and payload.min.css is 29 bytes. payload.bundle.min.js carries the payload and runs at require time as a top-level IIFE; it first deletes its own require.cache entries so that it runs again on every require. Module names, commands and URLs are encoded as numeric arrays and decoded at runtime.\n\nBehavior: (1) obtains child_process to execute system commands; (2) runs whoami, id and uname -a with execSync and sends each output, together with os.hostname() and the tag vector=registryLibrariesTopology, to https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418 through both fetch and https.get; (3) sends a beacon tagged topology-rce-v7 with the Node version, platform, process id and timestamp; (4) exports Proxy objects under Wix-internal module names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, autoCompleteRegistry, thunderboltBuilderRegistry, thunderboltPreviewRegistry), and the two rb_*.thunderbolt.manifest.min.json files list the payload under https://unpkg.com/css-nesting-transform@1.0.0/, which indicates a dependency-confusion attempt against that organization's private packages.\n\nTrigger: on import (require). Type: information stealer (host and user identity). Same collector path as wix-ssr-thunderbolt-grid-polyfill@0.1.0 (published 2026-10-06 20:21 UTC by user hissakdx92), which performs port scanning and host reconnaissance for the same target, and same payload family as css-flow-render-shim@1.0.0, css-jptvix-polyfill@1.0.0 and css-eqxcdx-polyfill.","state":0,"publishedAt":"2026-10-08T06:00:00+00:00","modifiedAt":"2026-10-12T04:45:05.8419105+00:00","affected":[{"ecosystem":"npm","name":"css-nesting-transform","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":[],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17804","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17804","identifiers":["MAL-2026-17804"]},"retained":false,"historicalAffected":[]}],"coverage":[]}