MAL-2026-17482

    Dashboard / Malicious Package / MAL-2026-17482

    MAL-2026-17482

    Published: 4 Oct 2026Last Modified: 4 Oct 2026

    Summary: Malicious code in css-logical-prop-shim (npm)

    Details: Source: amazon-inspector (d0ffba65f80ee8f200199c8c90ebb6297b8590537c80ea50bb34874d91665b5f) The package ships thunderboltRegistry.js which imports child_process and invokes execSync with curl commands at multiple sites (lines 30, 39, 47, 48). The declared purpose of the package is a CSS logical-property shim, which has no legitimate need to spawn shells or make outbound curl requests. The co-location of child_process + repeated execSync('curl...') calls in a package whose stated purpose is a frontend CSS polyfill is the shape of a dropper or exfiltration helper rather than library code, and the file name 'thunderboltRegistry' is unrelated to any CSS functionality.

    References: https://www.npmjs.com/package/css-logical-prop-shim/v/1.0.0

    Affected packages

    Package

    Name: css-logical-prop-shim

    Purl: pkg:npm/css-logical-prop-shim

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0