Malicious code in css-light-dark-polyfill (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (856c154d7855924568c88181f172f46e84aac202bd6cb29974eb2ffaa3ec3ea7) The package presents itself as a trivial CSS polyfill (index.js exports an empty object) but ships thunderboltRegistry.js, which on load runs a self-invoking IIFE that collects host identifiers (os.hostname, node version, platform, pid) and the output of local shell commands (id, whoami, uname -a, ifconfig/ip addr, /etc/hosts via child_process.execSync) and POSTs each result via fetch() to the hardcoded endpoint https://dxpoc.gt.tc/callback.php/. The payload self-labels as 'beacon=rce-poc'. The package also exports factories under the names of internal Wix Thunderbolt build registries (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, etc.), and a bundled registry-manifest.min.json maps those names to parastorage.com URLs — a dependency-confusion shape targeting Wix-like build systems that resolve these internal registry module names. Installing or loading this package causes host reconnaissance data to be exfiltrated to an attacker-controlled domain unrelated to any CSS polyfill functionality.

Source published

4 Oct 2026 23:14:43 UTC

Source modified

4 Oct 2026 23:30:05 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.