css-txedrf-polyfill

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (7d70c660ff3138360df0239fc6ef3db7beaca61ca069bc2d108ed893c68acb63)
thunderboltRegistry.js executes an IIFE at require time that runs OS reconnaissance commands (id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts) via child_process.execSync, URL-encodes the output together with hostname, node version, platform, and pid, and POSTs/GETs each result via fetch to the hardcoded endpoint http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f over plain HTTP. The package's exported module names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry) impersonate Wix thunderbolt internal registry modules and the manifest references static.parastorage.com URLs, consistent with a dependency-confusion lure aimed at a private Wix namespace. Any consumer that requires one of these modules triggers the reconnaissance and exfiltration to the attacker-controlled host.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/css-txedrf-polyfill/MAL-2026-17558.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/css-txedrf-polyfill/MAL-2026-17558.json
- https://www.npmjs.com/package/css-txedrf-polyfill/v/1.0.0
- https://github.com/advisories/GHSA-xjj7-95rf-xxgq

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.