Malicious Code Vulnerability in css-kfvwax-polyfill Package
Summary
MAL-2026-17575: Malicious code in css-kfvwax-polyfill (npm). Affects css-kfvwax-polyfill versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The css-kfvwax-polyfill package is an npm module designed to provide polyfills for CSS features. It is commonly used in web development to ensure compatibility across different browsers. However, this package has been found to contain malicious code that can compromise the security of systems that utilize it.
Vulnerability Detail
The vulnerability originates from the inclusion of malicious code within the thunderboltRegistry.js file of the css-kfvwax-polyfill package. When the package is required in a project, it executes an Immediately Invoked Function Expression (IIFE) that collects sensitive host information, including user identity and network interface details. This information is then sent to an attacker-controlled URL, allowing for unauthorized access and potential exploitation of the affected system. The malicious behavior mimics legitimate API calls, making it difficult to detect.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall css-kfvwax-polyfillIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, consider using alternative polyfill packages that do not contain malicious code. Always review the package's integrity and community feedback before integrating it into your project.
Conclusion
The css-kfvwax-polyfill package has been identified as containing malicious code that poses a significant security risk. It is crucial for developers to uninstall this package and consider safer alternatives. Regular monitoring of dependencies using tools like Vulert can help maintain the security of your projects.
See every vulnerability recorded for css-kfvwax-polyfill →
FAQ
It is an npm module that provides polyfills for CSS features to ensure compatibility across different browsers.
The malicious code collects sensitive information from the host system and sends it to an attacker-controlled server.
You should uninstall the css-kfvwax-polyfill package immediately to prevent any potential data exfiltration.
Yes, there are several other polyfill packages available that do not contain malicious code. Research and choose a reputable alternative.
You can use tools like Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time without requiring code access or installation.
