Vulnerability MAL-2026-17804

[email protected] was published to npm on 2026-10-07 01:32 UTC by user brahimhamidi (the same account that published [email protected] on 2026-10-06). It is described as a CSS polyfill but contains none: index.js is an empty module (byte-identical to the index.js of [email protected]) and payload.min.css is 29 bytes. payload.bundle.min.js carries the payload and runs at require time as a top-level IIFE; it first deletes its own require.cache entries so that it runs again on every require. Module names, commands and URLs are encoded as numeric arrays and decoded at runtime.

Behavior: (1) obtains child_process to execute system commands; (2) runs whoami, id and uname -a with execSync and sends each output, together with os.hostname() and the tag vector=registryLibrariesTopology, to https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418 through both fetch and https.get; (3) sends a beacon tagged topology-rce-v7 with the Node version, platform, process id and timestamp; (4) exports Proxy objects under Wix-internal module names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, autoCompleteRegistry, thunderboltBuilderRegistry, thunderboltPreviewRegistry), and the two rb_*.thunderbolt.manifest.min.json files list the payload under https://unpkg.com/[email protected]/, which indicates a dependency-confusion attempt against that organization's private packages.

Trigger: on import (require). Type: information stealer (host and user identity). Same collector path as [email protected] (published 2026-10-06 20:21 UTC by user hissakdx92), which performs port scanning and host reconnaissance for the same target, and same payload family as [email protected], [email protected] and css-eqxcdx-polyfill.