Malicious code in noelc-css-blender (npm)

{
  "id": "78367ba8ae6edb936cb5ed99c92bd169b8840550d059745f50f21617a9ca617e",
  "url": "https://osv.dev/vulnerability/MAL-2026-18249",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in noelc-css-blender (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1af88de104874d73dc5e8853fec7d4ca8b0c2c1dfa26a3cff9e44fac7eb30ea6) noelc-css-blender@2.1.11 declares itself as a 'tiny ESM utility for blending CSS custom-property token maps' with zero dependencies, but ships two heavily obfuscated single-line files totaling roughly 460 KB: index.mjs (~291 KB) and build-cache.mjs (~177 KB). Both consist of hex-named identifiers (`_0x...`) referencing large custom-encoded string arrays rather than readable code; the declared merge-two-token-maps functionality would require on the order of a dozen lines of plain JavaScript. The files carry fabricated 'auto-generated' header comments that misstate the package identity: index.mjs claims to be auto-generated by noelc-css-blender@2.2.1 (a different version than the actual 2.1.11 package), and build-cache.mjs claims to be auto-generated by tailwindcss-theme-kit@0.2.0, an unrelated package name. The headers additionally include 'restore from package-lock if corrupted' phrasing that functions as cover text discouraging inspection. package.json sets `main: index.mjs`, so any consumer that `require`s or `import`s noelc-css-blender executes the full obfuscated bundle at module load; there are no install lifecycle hooks, so the auto-executed surface is import-time rather than install-time. The string arrays use a custom (non-standard base64/XOR) encoding, so the specific sinks (network destinations, filesystem reads, ",
    "evidence": "osv:MAL-2026-18249",
    "products": [
      {
        "name": {
          "value": "noelc-css-blender",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "2.2.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.1.11",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.1.9",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.2.1",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-18249",
      "aliases": [
        "GHSA-cj2x-975v-jmwf",
        "MAL-2026-18249"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "noelc-css-blender",
            "purl": "pkg:npm/noelc-css-blender",
            "ecosystem": "npm"
          },
          "versions": [
            "2.2.0",
            "2.1.11",
            "2.1.9",
            "2.2.1"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/noelc-css-blender/MAL-2026-18249.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "index.mjs",
                  "tlsh": "2a54639163d92b61b5b97ed7a45f41e0cd30290cbd89f8c9f92c391c0a93512e6ceb72",
                  "sha256": "62baab92771b1c4ad919ecac725164193892ea94519354fcc74556de0863a9fd"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-26T06:45:16.872621678Z",
      "provider": "osv",
      "references": [
        "https://github.com/advisories/GHSA-cj2x-975v-jmwf",
        "https://www.npmjs.com/package/noelc-css-blender/v/2.2.0",
        "https://www.npmjs.com/package/noelc-css-blender/v/2.1.11",
        "https://www.npmjs.com/package/noelc-css-blender/v/2.1.9",
        "https://www.npmjs.com/package/noelc-css-blender/v/2.2.1"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "GHSA-cj2x-975v-jmwf",
            "ranges": [
              {
                "type": "SEMVER",
                "events": [
                  {
                    "introduced": "0"
                  }
                ]
              }
            ],
            "sha256": "dd5aa005958728cd9ab05682a4915f92e1c35734dde85dda3a6b747e02f7fe63",
            "source": "ghsa-malware",
            "import_time": "2026-10-25T01:00:16.33364337Z",
            "modified_time": "2026-10-24T23:55:21Z"
          },
          {
            "id": "IN-MAL-2026-021734",
            "sha256": "05d7734bcef74c01baa8ac1bacadee6f35342aa98bdfd44f261b14de92f8e45a",
            "source": "amazon-inspector",
            "versions": [
              "2.2.0"
            ],
            "import_time": "2026-10-26T06:39:38.815579787Z",
            "modified_time": "2026-10-26T05:48:19Z"
          },
          {
            "id": "IN-MAL-2026-021737",
            "sha256": "1af88de104874d73dc5e8853fec7d4ca8b0c2c1dfa26a3cff9e44fac7eb30ea6",
            "source": "amazon-inspector",
            "versions": [
              "2.1.11"
            ],
            "import_time": "2026-10-26T06:39:39.123463815Z",
            "modified_time": "2026-10-26T05:48:49Z"
          },
          {
            "id": "IN-MAL-2026-021735",
            "sha256": "20e34a5a90c081279744326ebba1c8592911912e7951462c7ec0da338dbc00cd",
            "source": "amazon-inspector",
            "versions": [
              "2.1.9"
            ],
            "import_time": "2026-10-26T06:39:38.988141301Z",
            "modified_time": "2026-10-26T05:48:32Z"
          },
          {
            "id": "IN-MAL-2026-021736",
            "sha256": "376c97c3aa796232bb119520da720155254dcdec6966cf156e18bd8cd85500d6",
            "source": "amazon-inspector",
            "versions": [
              "2.2.1"
            ],
            "import_time": "2026-10-26T06:39:39.058046947Z",
            "modified_time": "2026-10-26T05:48:40Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 446743,
  "published_at": "2026-10-24T23:55:21+00:00"
}