MAL-2026-17576

    Dashboard / Malicious Package / MAL-2026-17576

    MAL-2026-17576

    Published: 5 Oct 2026Last Modified: 5 Oct 2026

    Summary: Malicious code in css-nrmgzn-polyfill (npm)

    Details: Source: amazon-inspector (4522148c469356aa7799c831ce547d2ae612ac40621e5110ad5d5125bf2f2684) The package presents itself as a CSS polyfill but on require() of thunderboltRegistry.js runs an IIFE that invokes child_process.execSync for id, whoami, uname, ifconfig, and cat /etc/hosts, and sends the command output together with os.hostname(), node version, platform and pid to a hardcoded Burp Collaborator subdomain at https://unl9pgk6ei4uf80n5tf4iktspjvbuzkn9.oastify.com/. The package also exports modules named after internal Wix thunderbolt registries (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, documentManagementRegistry) and ships a manifest referencing static.parastorage.com paths for css-nrmgzn-polyfill, consistent with a dependency-confusion lure positioned to resolve in place of a private internal module in a Wix build or CI environment. Loading the package yields host reconnaissance exfiltration to an attacker-controlled OAST domain, with no polyfill functionality actually implemented.

    References: https://www.npmjs.com/package/css-nrmgzn-polyfill/v/1.0.0

    Affected packages

    Package

    Name: css-nrmgzn-polyfill

    Purl: pkg:npm/css-nrmgzn-polyfill

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0