css-ikomdq-polyfill@1.0.0: Malicious npm security report (Block)

OSV Malicious Advisory

imported 3d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-17553 confirms this npm version as malicious. The package presents itself as a CSS polyfill but ships thunderboltRegistry.js, which on require() executes a top-level IIFE that runs id, whoami, uname -a, ifconfig/ip addr, and reads /etc/hosts via child_process.execSync, then posts the command outputs together with hostname, node version, platform, and pid to the hardcoded plain-HTTP endpoint http://dxpoc.gt.tc/callback.php/ using fetch...

Advisory

MAL-2026-17553

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in css-ikomdq-polyfill (npm)

Details

The package presents itself as a CSS polyfill but ships thunderboltRegistry.js, which on require() executes a top-level IIFE that runs id, whoami, uname -a, ifconfig/ip addr, and reads /etc/hosts via child_process.execSync, then posts the command outputs together with hostname, node version, platform, and pid to the hardcoded plain-HTTP endpoint http://dxpoc.gt.tc/callback.php/ using fetch. The module also deletes its own entries from require.cache so the payload re-runs on each require() rather than being memoized. The package name and the thunderbolt/editor/corvid Proxy facade impersonate Wix parastorage registry modules to encourage accidental installation.

Decision reason

OpenSSF Malicious Packages via OSV confirms css-ikomdq-polyfill@1.0.0 as malicious (MAL-2026-17553): Malicious code in css-ikomdq-polyfill (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

css-ikomdq-polyfill@1.0.0

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code