css-ikomdq-polyfill

GHSA-vfrj-frg7-gx5v

Malicious code in css-ikomdq-polyfill (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (255cceca3ca8631c9b225745c5b64a71fd6c09b60fa3ad95b419fccb66f035f2)
The package presents itself as a CSS polyfill but ships thunderboltRegistry.js, which on require() executes a top-level IIFE that runs id, whoami, uname -a, ifconfig/ip addr, and reads /etc/hosts via child_process.execSync, then posts the command outputs together with hostname, node version, platform, and pid to the hardcoded plain-HTTP endpoint http://dxpoc.gt.tc/callback.php/ using fetch. The module also deletes its own entries from require.cache so the payload re-runs on each require() rather than being memoized. The package name and the thunderbolt/editor/corvid Proxy facade impersonate Wix parastorage registry modules to encourage accidental installation.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/css-ikomdq-polyfill/MAL-2026-17553.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/css-ikomdq-polyfill/MAL-2026-17553.json
- https://www.npmjs.com/package/css-ikomdq-polyfill/v/1.0.0
- https://github.com/advisories/GHSA-vfrj-frg7-gx5v

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.