Malicious Code Execution in css-starting-style-polyfill Package
Summary
MAL-2026-17488: Malicious code in css-starting-style-polyfill (npm). Affects css-starting-style-polyfill versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The css-starting-style-polyfill is an npm package designed to provide a polyfill for CSS starting styles. It is intended to enhance the styling capabilities of web applications. However, this package has been compromised, embedding malicious code that executes host reconnaissance commands, posing significant security risks to users.
Vulnerability Detail
The vulnerability originates from the thunderboltRegistry.js file within the css-starting-style-polyfill package. Upon loading the module, it executes an Immediately Invoked Function Expression (IIFE) that runs several host reconnaissance commands using child_process.execSync. These commands include 'id', 'whoami', 'uname -a', 'ifconfig/ip addr', and 'cat /etc/hosts'. The collected output, along with the hostname, platform, and process ID, is sent to a hardcoded external URL via a fetch request. This malicious behavior is disguised under the guise of a legitimate polyfill, leading to potential data exfiltration and unauthorized access to sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall css-starting-style-polyfillIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As an immediate workaround, consider removing the css-starting-style-polyfill package from your project until a secure version is released. You can do this by executing: 'npm uninstall css-starting-style-polyfill'. Additionally, monitor your application for any suspicious activity.
Conclusion
The css-starting-style-polyfill package has been compromised, embedding malicious code that can execute host commands and exfiltrate sensitive information. It is essential to update the package or remove it from your project to mitigate potential risks. Utilize tools like Vulert to monitor your application for vulnerabilities.
See every vulnerability recorded for css-starting-style-polyfill →
FAQ
It is an npm package designed to provide a polyfill for CSS starting styles, enhancing web application styling capabilities.
The malicious code executes host commands and exfiltrates sensitive information to an external server, compromising your application's security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
As a temporary measure, remove the package from your project and monitor for any unusual behavior in your application.
You can reach out to Amazon Inspector at inspector-research@amazon.com for further inquiries regarding this vulnerability.
