MAL-2026-17552

    Dashboard / Malicious Package / MAL-2026-17552

    MAL-2026-17552

    Published: 5 Oct 2026Last Modified: 5 Oct 2026

    Summary: Malicious code in css-hgwctv-polyfill (npm)

    Details: Source: amazon-inspector (ee1103a16c6f933686f07e8ce94068057f49e5cf2f0a6a9ccf01f2baeb7cfe95) On require, thunderboltRegistry.js runs an immediately-invoked function that uses child_process.execSync to collect host identity and network reconnaissance from the installer's machine (`id`, `whoami`, `uname -a`, `ifconfig`/`ip addr`, and `/etc/hosts`), plus hostname, Node.js version, platform and pid, and transmits each result via fetch to the hardcoded plain-HTTP endpoint http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f. The package also exports Proxy stubs named thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry and ships a registry-manifest.min.json referencing parastorage.com, mimicking internal Wix thunderbolt build modules so the module auto-loads inside a Wix build and executes the reconnaissance payload. A CSS polyfill has no functional reason to execute shell commands, read /etc/hosts, or contact an external host.

    References: https://www.npmjs.com/package/css-hgwctv-polyfill/v/1.0.0

    Affected packages

    Package

    Name: css-hgwctv-polyfill

    Purl: pkg:npm/css-hgwctv-polyfill

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0