css-ayucyz-polyfill

GHSA-2wxc-f4mp-28fp

Malicious code in css-ayucyz-polyfill (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (d8c7540d3981f510255434529f76a2ed9a24b0783e7e8e3369b41f71b93ebd1a)
On require, thunderboltRegistry.js runs an IIFE that acquires child_process via multiple fallbacks and executes shell commands (id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts), then GETs the collected output along with the hostname, platform and Node version to the hardcoded plain-HTTP endpoint http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f. One of the beacons is self-labeled beacon=rce-poc. The package presents itself as a CSS polyfill and exposes modules named thunderboltRegistry, siteAssetsRegistry, editorRegistry and corvidRegistry — internal Wix Thunderbolt names — behind a Proxy returning no-op functions, with registry-manifest.min.json pointing fake entries at a static.parastorage.com URL, so a consumer that resolves this package in place of the real Wix internals loads the exfiltration IIFE while the facade silently returns no-ops.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/css-ayucyz-polyfill/MAL-2026-17548.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/css-ayucyz-polyfill/MAL-2026-17548.json
- https://www.npmjs.com/package/css-ayucyz-polyfill/v/1.0.0
- https://github.com/advisories/GHSA-2wxc-f4mp-28fp

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.