{"answers":{"affected":"1 open source package ship an affected version, including css-flow-render-shim.","exploited":"There is no known exploitation of MAL-2026-17655 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17655 is a malicious package in css-flow-render-shim, published on 8 Oct 2026."},"fix_prompt":"MAL-2026-17655 is a malicious package: css-flow-render-shim (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17655/ (Markdown: https://insights.sbomify.com/MAL-2026-17655/index.md)","id":"MAL-2026-17655","markdown":"https://insights.sbomify.com/MAL-2026-17655/index.md","name":"MAL-2026-17655","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"css-flow-render-shim@1.0.0 was published to npm on 2026-10-06 22:49 UTC by user brahimhamidi (the account's only package). It is described as a CSS polyfill but contains none: index.js is an empty module (byte-identical to the index.js of css-jptvix-polyfill@1.0.0) and payload.min.css is 15 bytes. payload.bundle.min.js carries the payload and runs at require time as a top-level IIFE; it first deletes its own require.cache entries so that it runs again on every require.\n\nBehavior: (1) obtains child_process through require('child_process'), require('node:child_process') or a freshly constructed Module instance if both are blocked (lines 29-31); (2) runs whoami, id, uname -a, env (first 100 lines, 2,000 characters sent), ifconfig || ip addr, and cat /etc/hosts with execSync and sends each output, together with os.hostname() and the tag vector=registryLibrariesTopology, to https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418 through both fetch and https.get (lines 12-56); the env step exfiltrates the host's environment variables, including any tokens; (3) sends a beacon tagged topology-rce with the Node version, platform, process id and package name (line 60); (4) exports Proxy objects under Wix-internal module names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, autoCompleteRegistry, thunderboltBuilderRegistry, thunderboltPreviewRegistry), and the two rb_*.thunderbolt.manifest.min.json files list the payload under https://unpkg.com/css-flow-render-shim@1.0.0/, which indicates a dependency-confusion attempt against that organization's private packages (lines 65-98).\n\nTrigger: on import (require). Type: information stealer (host identity, network configuration and environment variables). Same collector path as wix-ssr-thunderbolt-grid-polyfill@0.1.0 (published 2026-10-06 20:21 UTC by user hissakdx92), which performs port scanning and host reconnaissance for the same target, and same payload family as css-jptvix-polyfill@1.0.0 and css-eqxcdx-polyfill.\n\nThe package publishes an empty index.js stub but ships Thunderbolt manifests that register payload.bundle.min.js as the bundle for core Wix components across the thunderbolt/wixui and thunderbolt/dsgnsys namespaces (Container, MasterPage, Section, StylableButton, WRichText, and others), and the bundle exports factories under names like thunderboltRegistry, editorRegistry, and corvidRegistry. When a Wix Thunderbolt build pipeline resolves this name from the public registry instead of the intended internal package, payload.bundle.min.js is loaded and its top-level IIFE executes immediately. The IIFE uses child_process.execSync to run whoami, id, uname -a, env | head -100, ifconfig/ip addr, and cat /etc/hosts, then URL-encodes each output along with hostname, node version, platform, and pid and sends it via https.get to a hardcoded collector at https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418. The payload also iterates require.cache and deletes every entry whose path contains payload, rb_wixui, or rb_dsgnsys so the recon routine re-fires on each subsequent require within a long-running build process. The combination of a hollow public package impersonating an internal Wix shim, Thunderbolt-shaped manifests, host and environment reconnaissance via shell commands, exfiltration to an attacker-controlled webhook.site endpoint, and require.cache tampering is a dependency-confusion attack against Wix build systems.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in css-flow-render-shim (npm)","id":"MAL-2026-17655","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"css-flow-render-shim","purl":"pkg:npm/css-flow-render-shim","source":"MAL-2026-17655"}],"products":null,"published":"2026-10-08","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17655/"}