Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Malicious package

focus-visible-polyfill-litenpm

Advisory published Updated

focus-visible-polyfill-lite is a confirmed malicious npm package (MAL-2026-17491) that opens a backdoor for remote access (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in focus-visible-polyfill-lite (npm)

MAL-2026-17491
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall focus-visible-polyfill-lite

What this malware does

The package is advertised as a focus-visible polyfill but ships thunderboltRegistry.js, which impersonates Wix thunderbolt internal registry modules (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, and others) via a Proxy-backed export stub. When the module is required, an IIFE at the top of the file uses child_process.execSync to run host reconnaissance commands (id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts) and sends the command output along with a beacon (Node version, platform, pid) via plain-HTTP GET requests to a hardcoded attacker-controlled endpoint at http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. The package self-labels the beacon as 'rce-poc'. The shape is a dependency-confusion / typosquat payload: a benign-sounding public package shadows Wix-internal registry names so that a build pipeline resolving these names from the public registry executes the reconnaissance payload with the installer's privileges on module load.

Malicious versions

1 flagged
1.0.0

Indicators of compromise (SHA-256)

5225b5a8636a589f9b90272ad04c3f4104670a23d5c24b45f6aeaa757a4f2a2b

Detection & response playbook

Backdoor / remote access

  1. Find it

    Search your lockfiles and build artifacts for focus-visible-polyfill-lite (version 1.0.0).

  2. If you installed it — respond

    focus-visible-polyfill-lite establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

  3. Did it already run?

    If focus-visible-polyfill-lite was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. focus-visible-polyfill-lite on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-020876

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks focus-visible-polyfill-lite-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
focus-visible-polyfill-lite (npm) malicious package — MAL-2026-17491 | O3 Security