Malicious Code Injection in css-snap-target-polyfill Package
Summary
MAL-2026-17487: Malicious code in css-snap-target-polyfill (npm). Affects css-snap-target-polyfill versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The css-snap-target-polyfill is an npm package designed to provide CSS snap functionality for web applications. It allows developers to implement smooth scrolling and snapping behavior in their user interfaces. However, this package has been found to contain malicious code that compromises the security of applications using it.
Vulnerability Detail
The vulnerability originates from the inclusion of a file named thunderboltRegistry.js within the package. This file utilizes the child_process module and process.platform to gather sensitive host information and sends it to a hardcoded external endpoint (http://dxpoc.gt.tc) via a fetch() request. This behavior is unrelated to the intended functionality of a CSS polyfill and poses significant risks, including unauthorized data exfiltration and potential exploitation of the host system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall css-snap-target-polyfillIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the css-snap-target-polyfill package from your project until a secure version is released. You can do this by executing:
npm uninstall css-snap-target-polyfill
Consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The css-snap-target-polyfill package contains a serious vulnerability due to embedded malicious code that compromises application security. It is crucial to update or remove the package to protect your application from potential threats. Monitoring tools like Vulert can assist in identifying vulnerabilities in your project.
See every vulnerability recorded for css-snap-target-polyfill →
FAQ
It is an npm package that enables CSS snap functionality for web applications, allowing for smooth scrolling and snapping behavior.
The malicious code can collect sensitive host information and send it to an external server, potentially leading to data breaches and exploitation.
Check the package repository for updates. If a patched version is available, update the package using npm.
Consider removing the package from your project as a temporary measure and look for alternative solutions.
You can use Vulert to monitor your project for open-source vulnerabilities in real-time. It analyzes your package-lock.json file without requiring code access or installation.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
