Malicious Code Injection in css-scroll-state-polyfill Package
Summary
MAL-2026-17486: Malicious code in css-scroll-state-polyfill (npm). Affects css-scroll-state-polyfill versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The css-scroll-state-polyfill package is designed to provide a polyfill for CSS scroll state features, allowing developers to use these features in environments that do not support them natively. However, this package has been compromised, embedding malicious code that executes upon import, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability originates from a malicious payload included in the css-scroll-state-polyfill package, specifically in the file thunderboltRegistry.js. This file executes an Immediately Invoked Function Expression (IIFE) at the time of requiring the package, which uses child_process to run various host-identification commands. It collects sensitive information such as Node version, platform, and PID, and sends this data to a hardcoded external server. The malicious code also manipulates the require.cache to ensure that the payload is executed multiple times, further increasing the risk of data exfiltration.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall css-scroll-state-polyfillIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the css-scroll-state-polyfill package altogether and look for alternative libraries that provide similar functionality without the associated risks. Additionally, you can monitor your application for any suspicious activity that may arise from the use of this package.
Conclusion
The css-scroll-state-polyfill package has been compromised, embedding malicious code that poses significant security risks. It is essential to remove this package from your project and monitor for any suspicious activity. Always stay updated on package vulnerabilities and consider using tools like Vulert for real-time monitoring.
See every vulnerability recorded for css-scroll-state-polyfill →
FAQ
It is a JavaScript package that provides a polyfill for CSS scroll state features, allowing developers to use these features in unsupported environments.
The malicious code executes upon requiring the package, running host-identification commands and sending sensitive data to an external server.
You should immediately remove the css-scroll-state-polyfill package from your project and monitor your application for any unusual behavior.
Yes, consider using other libraries that provide similar functionality without the security risks associated with css-scroll-state-polyfill.
You can use Vulert, which monitors your package-lock.json for open-source vulnerabilities in real-time. You can also check your application using the Vulert playground at Vulert Scanner without any signup.
