MAL-2026-17487

    Dashboard / Malicious Package / MAL-2026-17487

    MAL-2026-17487

    Published: 4 Oct 2026Last Modified: 4 Oct 2026

    Summary: Malicious code in css-snap-target-polyfill (npm)

    Details: Source: amazon-inspector (00c104d427125b4acf88ecb83a58d563507b23bcb716cb87fbf7fc953d816d42) The package ships thunderboltRegistry.js, which uses child_process and process.platform to collect host information and POSTs it via fetch() to the hardcoded external endpoint http://dxpoc.gt.tc. The destination is unrelated to any CSS polyfill functionality the package name advertises, is served over cleartext HTTP, and is not caller-configurable. This behavior does not correspond to the declared purpose of a CSS snap-target polyfill, which has no legitimate need to execute shell commands or beacon host details to a third-party domain.

    References: https://www.npmjs.com/package/css-snap-target-polyfill/v/1.0.0

    Affected packages

    Package

    Name: css-snap-target-polyfill

    Purl: pkg:npm/css-snap-target-polyfill

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0