Malicious code in css-jptvix-polyfill (npm)

Source: amazon-inspector cea61788c370593a2720461d06b74942933d38d30b449851a05541b5b7f189aa The package ships thunderboltRegistry.js, a Proxy-based shim that exports names mimicking internal Wix thunderbolt modules thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry,...

MAL-2026-17638 Malicious code in css-jptvix-polyfill (npm)

[email protected] was published to npm on 2026-10-06 07:29 UTC by user naorya and was unpublished by npm on 2026-10-06 15:04 UTC after a malware report. It is described as a CSS polyfill but contains no polyfill: index.js is an empty module, registry-manifest.min.json maps Wix-internal...

Malicious code in css-jptvix-polyfill (npm)

[email protected] was published to npm on 2026-10-06 07:29 UTC by user naorya and was unpublished by npm on 2026-10-06 15:04 UTC after a malware report. It is described as a CSS polyfill but contains no polyfill: index.js is an empty module, registry-manifest.min.json maps Wix-internal...

MSC-2026-12682

The npm package css-jptvix-polyfill version 1.0.0 contains embedded malicious code in thunderboltRegistry.js. The file self-executes when loaded: it runs id, whoami, env and ifconfig via childprocess.execSync, sends the full process environment including any credentials and tokens to an...

Malicious Package

Overview css-jptvix-polyfill is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...