Malicious Code Injection in css-flow-render-shim: A Dependency Confusion Attack
Summary
MAL-2026-17655: Malicious code in css-flow-render-shim (npm). Affects css-flow-render-shim versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
css-flow-render-shim is an npm package designed to facilitate CSS flow rendering in web applications. It is commonly used in projects that rely on Wix's Thunderbolt framework. The package is intended to provide a lightweight and efficient solution for managing CSS styles, but it has been compromised, leading to significant security vulnerabilities.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within the css-flow-render-shim package. The package publishes an empty index.js file while including a harmful script (payload.bundle.min.js) that executes upon loading. This script performs reconnaissance on the host environment by executing shell commands to gather sensitive information, such as user identity, system details, and network configurations. The collected data is then sent to an attacker-controlled endpoint. This type of attack is classified as a dependency confusion attack, exploiting the package management system to load malicious code instead of the intended internal package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall css-flow-render-shimIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the css-flow-render-shim package from your project until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The css-flow-render-shim package has been compromised, leading to a serious vulnerability that allows for the execution of malicious code. It is crucial for developers using this package to take immediate action by updating or removing it to protect their applications from potential attacks.
See every vulnerability recorded for css-flow-render-shim →
FAQ
css-flow-render-shim is an npm package used for managing CSS flow rendering in web applications, particularly those built on the Wix Thunderbolt framework.
The vulnerability allows malicious code to execute within your application, potentially exposing sensitive information and compromising system security.
Immediately update the package to the latest version or remove it from your project until a secure version is available.
Yes, Vulert can monitor your project for open-source vulnerabilities using your package-lock.json file, providing real-time alerts for any issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
