Malicious Code Detected in css-logical-prop-shim Package - Potential Security Risk
Summary
MAL-2026-17482: Malicious code in css-logical-prop-shim (npm). Affects css-logical-prop-shim versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The css-logical-prop-shim package is an npm library designed to provide a polyfill for CSS logical properties, enabling developers to use logical properties in their stylesheets for better layout control. However, this package has been found to contain malicious code that undermines its intended functionality, posing a significant security risk to users who implement it in their projects.
Vulnerability Detail
The vulnerability originates from the inclusion of a file named thunderboltRegistry.js, which imports the child_process module and executes shell commands using execSync with curl requests to multiple external sites. This behavior is atypical for a CSS polyfill and suggests that the package may be acting as a dropper or exfiltration tool rather than a legitimate library. The presence of such malicious code can lead to unauthorized data access or compromise the integrity of the user's system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall css-logical-prop-shimIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using alternative libraries that provide similar functionality without the associated risks. Additionally, you can manually implement CSS logical properties in your stylesheets without relying on external packages.
Conclusion
The css-logical-prop-shim package has been identified as containing malicious code that poses a security risk to users. It is essential to remove this package from your projects and consider alternative solutions to avoid potential vulnerabilities. Stay informed about updates and patches from the official repository.
See every vulnerability recorded for css-logical-prop-shim →
FAQ
css-logical-prop-shim is an npm package that serves as a polyfill for CSS logical properties, allowing developers to use logical properties in their stylesheets.
The malicious code can execute shell commands and make outbound requests, potentially compromising your system's security and data integrity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
If you have installed the css-logical-prop-shim package, it is recommended to remove it immediately and look for alternative solutions.
Currently, there is no patched version available. It is advisable to monitor the official repository for any updates regarding this issue.
