Malicious code in css-nrmgzn-polyfill (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4522148c469356aa7799c831ce547d2ae612ac40621e5110ad5d5125bf2f2684) The package presents itself as a CSS polyfill but on require() of thunderboltRegistry.js runs an IIFE that invokes child_process.execSync for id, whoami, uname, ifconfig, and cat /etc/hosts, and sends the command output together with os.hostname(), node version, platform and pid to a hardcoded Burp Collaborator subdomain at https://unl9pgk6ei4uf80n5tf4iktspjvbuzkn9.oastify.com/. The package also exports modules named after internal Wix thunderbolt registries (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, documentManagementRegistry) and ships a manifest referencing static.parastorage.com paths for css-nrmgzn-polyfill, consistent with a dependency-confusion lure positioned to resolve in place of a private internal module in a Wix build or CI environment. Loading the package yields host reconnaissance exfiltration to an attacker-controlled OAST domain, with no polyfill functionality actually implemented.

Source published

5 Oct 2026 16:15:10 UTC

Source modified

5 Oct 2026 16:31:38 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.