Critical Malicious Code Vulnerability in css-interop-observer-polyfill Package
Summary
MAL-2026-17480: Malicious code in css-interop-observer-polyfill (npm). Affects css-interop-observer-polyfill versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The css-interop-observer-polyfill is an npm package designed to provide a polyfill for CSS interop observers, allowing developers to use modern CSS features in older environments. However, this package has been compromised, embedding malicious code that can execute harmful operations on the host system.
Vulnerability Detail
The vulnerability originates from the execution of an Immediately Invoked Function Expression (IIFE) within the thunderboltRegistry.js file. Upon loading the module, this code runs system commands such as 'id', 'whoami', 'uname', and 'ifconfig/ip addr' using child_process.execSync. It also reads the /etc/hosts file and sends the collected data, including hostname, node version, platform, and process ID, to a hardcoded endpoint via an unencrypted HTTP request. This poses significant security risks, including data exfiltration and potential system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall css-interop-observer-polyfillIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the css-interop-observer-polyfill package from your project until a secure version is released. You can do this by executing: 'npm uninstall css-interop-observer-polyfill'. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The css-interop-observer-polyfill package has been identified as containing malicious code that can compromise system security. It is essential to update or remove the package to mitigate risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for css-interop-observer-polyfill →
FAQ
It is an npm package that provides a polyfill for CSS interop observers, enabling the use of modern CSS features in older environments.
The malicious code executes system commands and reads sensitive information from the host, sending it to a remote server.
The risks include unauthorized data access, potential system compromise, and exposure of sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
Check the package repository for updates. If a patched version is available, update your package using 'npm update css-interop-observer-polyfill'.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
