css-hgwctv-polyfill

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (ee1103a16c6f933686f07e8ce94068057f49e5cf2f0a6a9ccf01f2baeb7cfe95)
On require, thunderboltRegistry.js runs an immediately-invoked function that uses child_process.execSync to collect host identity and network reconnaissance from the installer's machine (`id`, `whoami`, `uname -a`, `ifconfig`/`ip addr`, and `/etc/hosts`), plus hostname, Node.js version, platform and pid, and transmits each result via fetch to the hardcoded plain-HTTP endpoint http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f. The package also exports Proxy stubs named thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry and ships a registry-manifest.min.json referencing parastorage.com, mimicking internal Wix thunderbolt build modules so the module auto-loads inside a Wix build and executes the reconnaissance payload. A CSS polyfill has no functional reason to execute shell commands, read /etc/hosts, or contact an external host.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/css-hgwctv-polyfill/MAL-2026-17552.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/css-hgwctv-polyfill/MAL-2026-17552.json
- https://www.npmjs.com/package/css-hgwctv-polyfill/v/1.0.0
- https://github.com/advisories/GHSA-7q76-4xm4-4v93

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.