MAL-2026-17476

    Dashboard / Malicious Package / MAL-2026-17476

    MAL-2026-17476

    Published: 4 Oct 2026Last Modified: 4 Oct 2026

    Summary: Malicious code in css-anchor-pos-fallback (npm)

    Details: Source: amazon-inspector (bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05) The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs `id`, `whoami`, `uname -a`, `ifconfig`/`ip addr`, and reads `/etc/hosts`, then POSTs the collected output along with hostname, platform, and Node version via fetch to the hardcoded external endpoint http://dxpoc.gt.tc/callback.php/. The module also exports keys named after Wix thunderbolt internal registries (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, etc.) with a bundled manifest referencing a parastorage.com unpkg URL, a shape consistent with dependency-confusion targeting of an internal Wix build pipeline. The advertised polyfill purpose is unrelated to shell execution, host reconnaissance, or outbound beaconing.

    References: https://www.npmjs.com/package/css-anchor-pos-fallback/v/1.0.0

    Affected packages

    Package

    Name: css-anchor-pos-fallback

    Purl: pkg:npm/css-anchor-pos-fallback

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0