css-logical-prop-shim@1.0.0: Malicious npm security report

OSV Malicious Advisory

imported 4d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-17482 confirms this npm version as malicious. The package ships thunderboltRegistry.js which imports child_process and invokes execSync with curl commands at multiple sites (lines 30, 39, 47, 48). The declared purpose of the package is a CSS logical-property shim, which has no legitimate need to spawn shells or make outbound curl requests. The co-location of child_process + repeated execSync('curl...') calls in a package whose stated purpose is a frontend CSS...

Advisory

MAL-2026-17482

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in css-logical-prop-shim (npm)

Details

The package ships thunderboltRegistry.js which imports child_process and invokes execSync with curl commands at multiple sites (lines 30, 39, 47, 48). The declared purpose of the package is a CSS logical-property shim, which has no legitimate need to spawn shells or make outbound curl requests. The co-location of child_process + repeated execSync('curl...') calls in a package whose stated purpose is a frontend CSS polyfill is the shape of a dropper or exfiltration helper rather than library code, and the file name 'thunderboltRegistry' is unrelated to any CSS functionality.

Decision reason

OpenSSF Malicious Packages via OSV confirms css-logical-prop-shim@1.0.0 as malicious (MAL-2026-17482): Malicious code in css-logical-prop-shim (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

css-logical-prop-shim@1.0.0

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code