MSC-2026-12686

The npm package css-flow-render-shim version 1.0.0 contains embedded malicious code in payload.bundle.min.js. Forged Wix Thunderbolt registry manifests rbwixui and rbdsgnsys bind core Wix components such as Container, BackgroundGroup and MasterPage to this payload with a base URL on unpkg.com, so...

Malicious code in css-display-reading-polyfill (npm)

Source: amazon-inspector b397798b7209f1094c33dc3ed721d4a3ef0536065317bd06bae76e33dd505334 The package ships payload.bundle.min.js, which on load runs an IIFE that invokes childprocess.execSync to run id, whoami, and uname, collects os.hostname, node version, process.platform, and pid, and transmi...