{"items":[{"id":"NVI-00010988","kind":"supply_chain_event","title":"Malicious code in css-svqggc-polyfill (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-67vj-fvv3-m9f5"],"plain_summary":"GitHub lists this malware advisory for css-svqggc-polyfill. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-84101a52c4bc9738bca0ac35404965d4"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-84101a52c4bc9738bca0ac35404965d4","url":"https://github.com/advisories/GHSA-67vj-fvv3-m9f5","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-67vj-fvv3-m9f5","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:05.881Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-84101a52c4bc9738bca0ac35404965d4"],"technology":"css-svqggc-polyfill","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (6b23cf39720388bcf9f26621bd52e256e18a011bf3b6821b7d9f5f60115b9663)\nPackage masquerades as a CSS polyfill while impersonating internal Wix Thunderbolt registry modules (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, and other namespace stubs), with a shipped registry-manifest pointing those names at parastorage.com URLs under this package's own name — a dependency-confusion shape. thunderboltRegistry.js runs an IIFE on require that purges its own entries from require.cache so each require re-runs the payload, obtains child_process via multiple fallbacks (including constructing a fresh Module instance to bypass sandboxed require stubs), and executes reconnaissance commands (id, whoami, uname -a, ifconfig/ip addr, /etc/hosts) via execSync. The command output plus host beacon fields (node version, platform, pid, hostname, site) are sent over cleartext HTTP via fetch GET to the hardcoded endpoint http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f. The Proxy-based stub exports ensure the import appears to succeed silently after exfiltration.\n\n---\n\nCredit: OpenSSF ([source](ht","public_affected_ranges":["= 1.0.0"]}],"null_published_at":"2026-10-31T23:18:22.419Z","source_updated_at":"2026-10-05T06:30:32.000Z","source_disclosed_at":"2026-10-05T06:30:30.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:05.881Z"}],"next_cursor":null,"snapshot_revision":"42594"}