{"items":[{"id":"NVI-00010799","kind":"supply_chain_event","title":"Malicious code in css-display-reading-polyfill (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-c8vg-2r7m-hfch"],"plain_summary":"GitHub lists this malware advisory for css-display-reading-polyfill. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0a1bb812c66f8ee842548d6c4dbc0737"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-0a1bb812c66f8ee842548d6c4dbc0737","url":"https://github.com/advisories/GHSA-c8vg-2r7m-hfch","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-c8vg-2r7m-hfch","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:05.881Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-0a1bb812c66f8ee842548d6c4dbc0737"],"technology":"css-display-reading-polyfill","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (b397798b7209f1094c33dc3ed721d4a3ef0536065317bd06bae76e33dd505334)\nThe package ships payload.bundle.min.js, which on load runs an IIFE that invokes child_process.execSync to run id, whoami, and uname, collects os.hostname(), node version, process.platform, and pid, and transmits the results to the hardcoded collector https://webhook.site/5e52603d-f802-4a6f-b91b-43c3a5b45b6b via fetch and https.get. The published name impersonates an internal Wix thunderbolt module: shipped thunderbolt manifest JSON files declare this package as the loader entry for dozens of Wix component registry names (Container, StylableButton, MasterPage,...) and nine host registries (thunderboltRegistry, editorRegistry, corvidRegistry,...), with \"shared\":[\"payload.bundle.min.js\"] and components mapped to that bundle. index.js is a benign stub; the exfil code lives entirely in the bundle, so any Wix runtime that resolves these internal registry names from this public package executes the host-reconnaissance payload. This is a dependency-confusion active attack: installer-side shell command output and host identifiers are sent to an attacker-controlled, non-first-party endpoint.\n\n---\n","public_affected_ranges":["= 1.0.0"]}],"null_published_at":"2026-10-31T23:18:22.387Z","source_updated_at":"2026-10-05T06:30:40.000Z","source_disclosed_at":"2026-10-05T06:30:29.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:05.881Z"}],"next_cursor":null,"snapshot_revision":"42594"}