Malicious Code Injection in css-a11y-contrast-utils: A Critical Vulnerability
Summary
MAL-2026-17475: Malicious code in css-a11y-contrast-utils (npm). Affects css-a11y-contrast-utils versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
css-a11y-contrast-utils is an npm package designed to assist developers in ensuring compliance with WCAG contrast standards. However, the version 1.0.0 of this package has been found to contain no actual contrast utility code. Instead, it exports an empty object and includes a Proxy that exposes identifiers from Wix's internal registry, making it a target for dependency confusion attacks.
Vulnerability Detail
The vulnerability originates from the malicious design of the css-a11y-contrast-utils package, which masquerades as a legitimate utility while executing harmful code upon loading. Specifically, it runs an IIFE that collects sensitive system information such as hostname, user ID, kernel version, Node version, and process ID. This data is then exfiltrated through DNS lookups and HTTP requests to hardcoded external servers, posing significant security risks to users who install this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall css-a11y-contrast-utilsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the css-a11y-contrast-utils package until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The css-a11y-contrast-utils package has been identified as containing malicious code that poses significant security risks. Users are advised to uninstall the package immediately and consider alternatives. Continuous monitoring for vulnerabilities is crucial to maintaining application security.
See every vulnerability recorded for css-a11y-contrast-utils →
FAQ
css-a11y-contrast-utils is an npm package intended to help developers ensure compliance with WCAG contrast standards.
The vulnerability allows malicious code to run on your system, potentially exfiltrating sensitive information and compromising your application's security.
Immediately uninstall the css-a11y-contrast-utils package and monitor your system for any unusual activity.
Yes, consider using other well-reviewed packages that provide WCAG contrast utilities without the security risks.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can also check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner.
