css-ikomdq-polyfillnpm
Advisory published Updated
css-ikomdq-polyfill is a confirmed malicious npm package (MAL-2026-17553) that runs destructive / sabotage code (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in css-ikomdq-polyfill (npm)
What this malware does
The package presents itself as a CSS polyfill but ships thunderboltRegistry.js, which on require() executes a top-level IIFE that runs id, whoami, uname -a, ifconfig/ip addr, and reads /etc/hosts via child_process.execSync, then posts the command outputs together with hostname, node version, platform, and pid to the hardcoded plain-HTTP endpoint http://dxpoc.gt.tc/callback.php/ using fetch. The module also deletes its own entries from require.cache so the payload re-runs on each require() rather than being memoized. The package name and the thunderbolt/editor/corvid Proxy facade impersonate Wix parastorage registry modules to encourage accidental installation.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Destructive / sabotageFind it
Search your lockfiles and build artifacts for css-ikomdq-polyfill (version 1.0.0).
If you installed it — respond
css-ikomdq-polyfill carries a destructive/sabotage payload. Remove it immediately, restore any affected data from clean backups, and verify integrity of build outputs that may have been tampered with.
Did it already run?
If css-ikomdq-polyfill was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks css-ikomdq-polyfill-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.