Critical Malicious Code Vulnerability in css-gvqmfn-polyfill Package
Summary
MAL-2026-17551: Malicious code in css-gvqmfn-polyfill (npm). Affects css-gvqmfn-polyfill versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The css-gvqmfn-polyfill package is an npm library designed to mimic the internal CSS polyfill naming conventions used by Wix. It aims to provide compatibility and functionality for various Wix-related projects. However, this package has been identified as containing malicious code that can compromise the security of applications utilizing it.
Vulnerability Detail
The vulnerability originates from a malicious implementation within the css-gvqmfn-polyfill package. When the thunderboltRegistry.js file is required, it executes a series of commands that collect sensitive system information, such as the hostname, Node version, platform, and process ID. This data is then sent to a hardcoded attacker endpoint over plain HTTP, posing a significant risk of remote code execution (RCE) and data leakage. The package also employs a deceptive mechanism by re-exporting registry names as no-op functions, making it appear functional while executing malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall css-gvqmfn-polyfillIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the css-gvqmfn-polyfill package from your project to mitigate the risk of exploitation. This can be done by executing the following command:
npm uninstall css-gvqmfn-polyfill
Additionally, monitor your application using Vulert, which can alert you in real-time for open-source vulnerabilities without requiring code access or installation.
Conclusion
The css-gvqmfn-polyfill package contains a critical vulnerability that can lead to remote code execution and data leakage. It is essential to update or remove the package to protect your application. Utilize tools like Vulert to monitor for vulnerabilities effectively.
See every vulnerability recorded for css-gvqmfn-polyfill →
FAQ
css-gvqmfn-polyfill is an npm package that mimics Wix's internal CSS polyfill naming conventions to provide compatibility for Wix-related projects.
The vulnerability allows malicious code to execute commands on your system, potentially leading to data leakage and remote code execution.
Check the npm registry for updates to the css-gvqmfn-polyfill package. If a patched version is available, update your package to mitigate the risk.
You can use Vulert to monitor your application for open-source vulnerabilities in real-time. It requires only the package-lock.json file and no installation.
If no patched version is available, consider removing the css-gvqmfn-polyfill package from your dependencies until a secure version is released.
