MAL-2026-17656 Malicious code in css-reading-display-polyfill (npm)

css-reading-display-polyfill is described as a CSS polyfill but contains no polyfill code. When its thunderboltRegistry.js is loaded, it runs id, whoami, uname -a, env, ifconfig and cat /etc/hosts and sends the output with the hostname to a webhook.site collector. The file also exports stubs name...

Malicious code in css-reading-display-polyfill (npm)

css-reading-display-polyfill is described as a CSS polyfill but contains no polyfill code. When its thunderboltRegistry.js is loaded, it runs id, whoami, uname -a, env, ifconfig and cat /etc/hosts and sends the output with the hostname to a webhook.site collector. The file also exports stubs name...