{"answers":{"affected":"1 open source package ship an affected version, including css-ayucyz-polyfill.","exploited":"There is no known exploitation of MAL-2026-17548 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17548 is a malicious package in css-ayucyz-polyfill, published on 5 Oct 2026."},"fix_prompt":"MAL-2026-17548 is a malicious package: css-ayucyz-polyfill (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17548/ (Markdown: https://insights.sbomify.com/MAL-2026-17548/index.md)","id":"MAL-2026-17548","markdown":"https://insights.sbomify.com/MAL-2026-17548/index.md","name":"MAL-2026-17548","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On require, thunderboltRegistry.js runs an IIFE that acquires child_process via multiple fallbacks and executes shell commands (id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts), then GETs the collected output along with the hostname, platform and Node version to the hardcoded plain-HTTP endpoint http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f. One of the beacons is self-labeled beacon=rce-poc. The package presents itself as a CSS polyfill and exposes modules named thunderboltRegistry, siteAssetsRegistry, editorRegistry and corvidRegistry — internal Wix Thunderbolt names — behind a Proxy returning no-op functions, with registry-manifest.min.json pointing fake entries at a static.parastorage.com URL, so a consumer that resolves this package in place of the real Wix internals loads the exfiltration IIFE while the facade silently returns no-ops.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in css-ayucyz-polyfill (npm)","id":"MAL-2026-17548","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"css-ayucyz-polyfill","purl":"pkg:npm/css-ayucyz-polyfill","source":"MAL-2026-17548"}],"products":null,"published":"2026-10-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17548/"}