Malicious code in css-nesting-transform (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

[email protected] was published to npm on 2026-10-07 01:32 UTC by user brahimhamidi (the same account that published [email protected] on 2026-10-06). It is described as a CSS polyfill but contains none: index.js is an empty module (byte-identical to the index.js of [email protected]) and payload.min.css is 29 bytes. payload.bundle.min.js carries the payload and runs at require time as a top-level IIFE; it first deletes its own require.cache entries so that it runs again on every require. Module names, commands and URLs are encoded as numeric arrays and decoded at runtime. Behavior: (1) obtains child_process to execute system commands; (2) runs whoami, id and uname -a with execSync and sends each output, together with os.hostname() and the tag vector=registryLibrariesTopology, to https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418 through both fetch and https.get; (3) sends a beacon tagged topology-rce-v7 with the Node version, platform, process id and timestamp; (4) exports Proxy objects under Wix-internal module names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, autoCompleteRegistry, thunderboltBuilderRegistry, thunderboltPreviewRegistry), and the two rb_*.thunderbolt.manifest.min.json files list the payload under https://unpkg.com/[email protected]/, which indicates a dependency-confusion attempt against that organization's private packages. Trigger: on import (require). Type: information stealer (host and user identity). Same collector path as [email protected] (published 2026-10-06 20:21 UTC by user hissakdx92), which performs port scanning and host reconnaissance for the same target, and same payload family as [email protected], [email protected] and css-eqxcdx-polyfill.

Source published

8 Oct 2026 06:00:00 UTC

Source modified

12 Oct 2026 04:45:05 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.