MAL-2026-17518

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/postcss-gap-fallback-util/MAL-2026-17518.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17518
Published
2026-10-04T23:26:45Z
Modified
2026-10-04T23:45:20Z
Summary
Malicious code in postcss-gap-fallback-util (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (5b54d5bd893bc377a77503059998e01ae3e338fd4d8ddac6fe2d7c71a3157cb5)

The package is published as a PostCSS gap fallback utility but ships thunderboltRegistry.js, which executes an IIFE on module load. The IIFE runs whoami, id, and hostname via child_process.execSync, curls the AWS instance metadata service at http://169.254.169.254/latest/meta-data/ for IAM role, instance-id, availability zone, and local IPv4, and sends the results to https://webhook.site/0492a36c-4d7b-408a-865c-226db25987ba along with DNS beacons to a host under oast.live. A registry-manifest.min.json maps multiple Wix-internal registry names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, thunderboltBuilderRegistry, thunderboltPreviewRegistry) to the same exfiltration file, and the module exports a Proxy returning no-op registry methods as a façade. The naming, manifest, and façade indicate a dependency-confusion payload targeting Wix build infrastructure; on any installer that requires one of the impersonated module names, shell identity, hostname, and (on EC2) AWS IAM role credentials/metadata are leaked to an attacker-controlled webhook and DNS collector.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020962",
            "import_time":  "2026-10-04T23:40:46.271402856Z",
            "modified_time":  "2026-10-04T23:26:45Z",
            "sha256":  "5b54d5bd893bc377a77503059998e01ae3e338fd4d8ddac6fe2d7c71a3157cb5",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / postcss-gap-fallback-util

Package

Name
postcss-gap-fallback-util
View open source insights on deps.dev
Purl
pkg:npm/postcss-gap-fallback-util

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "thunderboltRegistry.js",
            "sha256":  "8e566b606b643230d0e0d83ba77eb2ed206f1850c33737ebc005e1816e1aa51f",
            "tlsh":  "45a1117af656b0716e83b0789f7f610de07b9a432ca8abd0b8190db00f25559017a6f9"
        },
        {
            "path":  "registry-manifest.min.json",
            "sha256":  "cec86678845ca0b46112ce8e9ec65d92faedf5ad8e25e6dcf7277009fc815f29",
            "tlsh":  "ff119e9d0d03116b0fd0aa4fa40beb4ade0209460deed1a2755593b539251d513ea76b"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "postcss-gap-fallback-util-1.0.0.tgz",
            "hashes":  {
                "sha1":  "f760968c158d679c4cea323cec0fce43d95653c4",
                "sha512_sri":  "sha512-9/0VY4uCdT8K1A0n5tC27Gft5sWrHXji0D3UoqMUAgib5r6oBdSlesfu+rPyKp30TtPSErfmjLzFy8y1yQCvLQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/postcss-gap-fallback-util/MAL-2026-17518.json"