Malicious Code Injection in tiny-css-token-parser: A Security Threat
Summary
MAL-2026-17525: Malicious code in tiny-css-token-parser (npm). Affects tiny-css-token-parser versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tiny-css-token-parser is an npm package designed to parse CSS tokens. It is intended for developers looking to manipulate CSS in their applications. However, this package has been compromised, leading to significant security concerns due to the inclusion of malicious code that executes upon loading the module.
Vulnerability Detail
The vulnerability originates from the package's inclusion of a file named thunderboltRegistry.js, which executes an Immediately Invoked Function Expression (IIFE) on module load. This script collects sensitive information such as hostname, process ID, Node version, platform, and outputs from system commands like 'id' and 'uname -r'. The collected data is then exfiltrated to an external server via DNS/HTTP requests, posing a serious risk to user privacy and system security. The malicious behavior is disguised under the guise of a legitimate CSS token parser, making it a classic case of dependency confusion and reconnaissance against Wix's internetbrands build graph.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tiny-css-token-parserIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the tiny-css-token-parser package from your project until a secure version is released. This can be done by executing: npm uninstall tiny-css-token-parser. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The tiny-css-token-parser package has been compromised, leading to the execution of malicious code that collects sensitive information. It is essential to update the package or remove it from your project to mitigate the risks associated with this vulnerability. Utilize tools like Vulert to monitor your applications for vulnerabilities effectively.
See every vulnerability recorded for tiny-css-token-parser →
FAQ
tiny-css-token-parser is an npm package used for parsing CSS tokens, aimed at developers who need to manipulate CSS in their applications.
The vulnerability involves the execution of a script that collects sensitive system information and exfiltrates it to an external server, compromising user privacy.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Check the package repository for any updates or patches that address this vulnerability. If a patched version is available, update using npm update tiny-css-token-parser.
As a temporary measure, consider uninstalling the tiny-css-token-parser package and using alternative packages until a secure version is released.
