MAL-2026-17548 Malicious code in css-ayucyz-polyfill (npm)
Malicious package
Published
MAL-2026-17548 is a malicious package: css-ayucyz-polyfill (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-17548/ (Markdown: https://insights.sbomify.com/MAL-2026-17548/index.md)
- Package
- css-ayucyz-polyfill
- Registry
- npm
What is MAL-2026-17548?
MAL-2026-17548 is a malicious package in css-ayucyz-polyfill, published on 5 Oct 2026.
Official description
On require, thunderboltRegistry.js runs an IIFE that acquires child_process via multiple fallbacks and executes shell commands (id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts), then GETs the collected output along with the hostname, platform and Node version to the hardcoded plain-HTTP endpoint http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f. One of the beacons is self-labeled beacon=rce-poc. The package presents itself as a CSS polyfill and exposes modules named thunderboltRegistry, siteAssetsRegistry, editorRegistry and corvidRegistry — internal Wix Thunderbolt names — behind a Proxy returning no-op functions, with registry-manifest.min.json pointing fake entries at a static.parastorage.com URL, so a consumer that resolves this package in place of the real Wix internals loads the exfiltration IIFE while the facade silently returns no-ops.
What should I do about MAL-2026-17548?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.