Critical Malicious Code Vulnerability in postcss-gap-fallback-util Package
Summary
MAL-2026-17518: Malicious code in postcss-gap-fallback-util (npm). Affects postcss-gap-fallback-util versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
postcss-gap-fallback-util is an npm package designed as a PostCSS utility for handling CSS gap fallbacks. It is intended to enhance the compatibility of CSS grid layouts across different browsers. However, this package has been compromised, embedding malicious code that poses significant security risks to users and their environments.
Vulnerability Detail
The vulnerability originates from a malicious code embedded in the postcss-gap-fallback-util package, specifically in the thunderboltRegistry.js file. Upon loading the module, the code executes an Immediately Invoked Function Expression (IIFE) that runs system commands to gather sensitive information such as the user's identity, hostname, and AWS instance metadata. This information is then sent to an attacker-controlled webhook, potentially leading to unauthorized access and data breaches. The malicious code is disguised within a facade that mimics legitimate registry methods, indicating a sophisticated dependency-confusion attack targeting Wix build infrastructure.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall postcss-gap-fallback-utilIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the postcss-gap-fallback-util package from your project until a secure version is released. This can be done using the command: npm uninstall postcss-gap-fallback-util. Alternatively, consider using a different package that offers similar functionality without the associated risks.
Conclusion
The postcss-gap-fallback-util package contains a critical vulnerability due to embedded malicious code that compromises user security. It is essential to update or remove the package to mitigate risks and protect sensitive information. Utilizing tools like Vulert can help in monitoring and identifying such vulnerabilities in real-time.
See every vulnerability recorded for postcss-gap-fallback-util →
FAQ
The malicious code executes system commands to collect sensitive information and sends it to an external server controlled by attackers.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, consider removing the package from your project or using an alternative package until a secure version is available.
The malicious code can leak sensitive information such as AWS IAM role credentials, which could lead to unauthorized access to your cloud resources.
Regularly audit your dependencies, use tools like Vulert for monitoring, and ensure to only install packages from trusted sources.
