css-snap-target-polyfill

GHSA-x6m9-jxjp-c938

Malicious code in css-snap-target-polyfill (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (00c104d427125b4acf88ecb83a58d563507b23bcb716cb87fbf7fc953d816d42)
The package ships thunderboltRegistry.js, which uses child_process and process.platform to collect host information and POSTs it via fetch() to the hardcoded external endpoint http://dxpoc.gt.tc. The destination is unrelated to any CSS polyfill functionality the package name advertises, is served over cleartext HTTP, and is not caller-configurable. This behavior does not correspond to the declared purpose of a CSS snap-target polyfill, which has no legitimate need to execute shell commands or beacon host details to a third-party domain.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7a1f1382a84618fabc1c45e8b61e9c9cea6ea33f/osv/malicious/npm/css-snap-target-polyfill/MAL-2026-17487.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/7a1f1382a84618fabc1c45e8b61e9c9cea6ea33f/osv/malicious/npm/css-snap-target-polyfill/MAL-2026-17487.json
- https://www.npmjs.com/package/css-snap-target-polyfill/v/1.0.0
- https://github.com/advisories/GHSA-x6m9-jxjp-c938

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.