# MAL-2026-17483: Malicious code in css-reading-flow-polyfill (npm)


- **Type:** Malicious package
- **Package:** `css-reading-flow-polyfill` (npm)
- **Published:** 4 Oct 2026

## What is MAL-2026-17483?

MAL-2026-17483 is a malicious package in css-reading-flow-polyfill, published on 4 Oct 2026. 

### Official description

The package is published as css-reading-flow-polyfill but ships thunderboltRegistry.js, which impersonates internal Wix thunderbolt registry modules (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, and others) by exporting all of those names from a single payload file. On require, an IIFE in thunderboltRegistry.js uses child_process.execSync to run id, whoami, uname, ifconfig/ip-addr and read /etc/hosts, then fetches http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f over plain HTTP with the command output, hostname, Node version, platform and pid appended as query parameters. The module also walks require.cache and deletes any entry whose key contains 'thunderboltRegistry' so the recon-and-exfil IIFE re-runs on every require rather than being cached. index.js is an empty decoy; the stated CSS polyfill purpose is a cover story and the package has no implementation of that functionality.

## What should I do about MAL-2026-17483?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17483 is a malicious package: css-reading-flow-polyfill (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17483/ (Markdown: https://insights.sbomify.com/MAL-2026-17483/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17483

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17483/
Summaries are generated and may contain mistakes; the official description above is the record.