{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "thunderboltRegistry.js",
              "sha256": "a485cb48081ea590cab385a405886cfe6f30af7d415f30bc8d7937ace461b928",
              "tlsh": "e87154a5b99df02065c33438cb7f4049b4bbc6672d6caee0744899b01f7985c01be6f8"
            }
          ],
          "package_integrity": [
            {
              "filename": "css-at-scope-polyfill-1.0.0.tgz",
              "hashes": {
                "sha1": "5e679fcafebeb0bafea3ce347f5925a124661831",
                "sha512_sri": "sha512-gJRIBJ4jedfAMCc6/qOOoDOgtnSKR459y9B9QJKzPAUVDoAEhaFopx46jHmwCKBpXSeiKwodBEKGry8zkiyy4A=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "css-at-scope-polyfill"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-021024",
        "import_time": "2026-10-05T03:57:39.597500531Z",
        "modified_time": "2026-10-05T03:37:15Z",
        "sha256": "c4d8d974b7fabf04fa662971cd8041fb76775bf5ed2902cbbffed0f881e2036d",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c4d8d974b7fabf04fa662971cd8041fb76775bf5ed2902cbbffed0f881e2036d)\nPackage is published under a CSS-polyfill name but ships thunderboltRegistry.js, which exports Wix internal registry module names (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, etc.) so that a build resolving any of those names will load this file. On require(), an IIFE runs child_process.execSync to collect `id`, `whoami`, `uname`, `ifconfig`/`ip addr`, and the contents of /etc/hosts, plus a beacon containing node version, platform, pid, and hostname, and POSTs the output via fetch to the hardcoded HTTP endpoint http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f. The payload clears any require.cache entries referencing \u0027thunderboltRegistry\u0027 and acquires child_process through three fallbacks, including instantiating a new Module via module.constructor to bypass mocks or sandboxes. The declared CSS-polyfill purpose has no relation to this behavior; the shape is a dependency-confusion squat against internal Wix modules.\n",
  "id": "MAL-2026-17547",
  "modified": "2026-10-05T03:37:15Z",
  "published": "2026-10-05T03:37:15Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/css-at-scope-polyfill/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in css-at-scope-polyfill (npm)"
}