# MAL-2026-17804: Malicious code in css-nesting-transform (npm)


- **Type:** Malicious package
- **Package:** `css-nesting-transform` (npm)
- **Published:** 8 Oct 2026

## What is MAL-2026-17804?

MAL-2026-17804 is a malicious package in css-nesting-transform, published on 8 Oct 2026. 

### Official description

css-nesting-transform@1.0.0 was published to npm on 2026-10-07 01:32 UTC by user brahimhamidi (the same account that published css-flow-render-shim@1.0.0 on 2026-10-06). It is described as a CSS polyfill but contains none: index.js is an empty module (byte-identical to the index.js of css-jptvix-polyfill@1.0.0) and payload.min.css is 29 bytes. payload.bundle.min.js carries the payload and runs at require time as a top-level IIFE; it first deletes its own require.cache entries so that it runs again on every require. Module names, commands and URLs are encoded as numeric arrays and decoded at runtime.

Behavior: (1) obtains child_process to execute system commands; (2) runs whoami, id and uname -a with execSync and sends each output, together with os.hostname() and the tag vector=registryLibrariesTopology, to https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418 through both fetch and https.get; (3) sends a beacon tagged topology-rce-v7 with the Node version, platform, process id and timestamp; (4) exports Proxy objects under Wix-internal module names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, autoCompleteRegistry, thunderboltBuilderRegistry, thunderboltPreviewRegistry), and the two rb_*.thunderbolt.manifest.min.json files list the payload under https://unpkg.com/css-nesting-transform@1.0.0/, which indicates a dependency-confusion attempt against that organization's private packages.

Trigger: on import (require). Type: information stealer (host and user identity). Same collector path as wix-ssr-thunderbolt-grid-polyfill@0.1.0 (published 2026-10-06 20:21 UTC by user hissakdx92), which performs port scanning and host reconnaissance for the same target, and same payload family as css-flow-render-shim@1.0.0, css-jptvix-polyfill@1.0.0 and css-eqxcdx-polyfill.

## What should I do about MAL-2026-17804?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17804 is a malicious package: css-nesting-transform (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17804/ (Markdown: https://insights.sbomify.com/MAL-2026-17804/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17804

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17804/
Summaries are generated and may contain mistakes; the official description above is the record.