Malicious Code Injection in rgx33-css-grid-utils Package
Summary
MAL-2026-17520: Malicious code in rgx33-css-grid-utils (npm). Affects rgx33-css-grid-utils versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The rgx33-css-grid-utils package is an npm library that is purportedly designed for CSS grid utilities. However, it has been identified as a malicious package that does not provide any CSS grid functionality. Instead, it serves as a dependency-confusion lure targeting Wix's internal build and runtime namespaces. This package exports module keys that are associated with Wix's internal registries, making it a potential threat to applications that rely on it.
Vulnerability Detail
The rgx33-css-grid-utils package contains malicious code that executes upon loading the module. It collects sensitive host identifiers such as hostname, process ID, Node version, and platform. Additionally, it runs system commands to capture the current user and kernel version, which are then encoded and sent to an external server. This vulnerability poses significant risks, including unauthorized data collection and potential exploitation of the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall rgx33-css-grid-utilsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the rgx33-css-grid-utils package entirely. If your project relies on CSS grid utilities, consider using alternative, reputable packages that do not exhibit malicious behavior.
Conclusion
The rgx33-css-grid-utils package poses a significant security threat due to its embedded malicious code. It is essential for developers to remove this package from their projects and utilize alternative solutions for CSS grid utilities. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for rgx33-css-grid-utils →
FAQ
It is an npm package that falsely claims to provide CSS grid utilities but contains malicious code.
The code collects sensitive information from the host system and sends it to external servers.
The risks include unauthorized data collection, potential system exploitation, and compromise of sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Immediately uninstall the package and review your project for any potential security issues that may have arisen from its use.
