Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Malicious package

rgx33-css-grid-utilsnpm

Advisory published Updated

rgx33-css-grid-utils is a confirmed malicious npm package (MAL-2026-17520) that opens a backdoor for remote access (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in rgx33-css-grid-utils (npm)

MAL-2026-17520
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall rgx33-css-grid-utils

What this malware does

The package is published as rgx33-css-grid-utils but exports a set of module keys matching Wix thunderbolt internal registries (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, documentManagementRegistry, and others) — a dependency-confusion lure targeting Wix's internal build/runtime namespace. On module load, an IIFE collects host identifiers (hostname, pid, Node version, platform) and runs child_process.execSync('id') and child_process.execSync('uname -r') to capture the current user and kernel version. These values are encoded as DNS subdomain labels and sent via fetch to the interactsh/OOB collector davdpb8lhot13kgmnhp0863x9g83mpswq.oast.live, and in parallel to https://webhook.site/0492a36c-4d7b-408a-865c-226db25987ba with a where=wix-blog query parameter identifying the campaign target. The package ships no CSS grid functionality consistent with its name; the reconnaissance beacon is the entire payload.

Malicious versions

1 flagged
1.0.0

Indicators of compromise (SHA-256)

320488b79c9000782e398425aa1a2fddba7f29a487913bbb2fc2019405c078f5

Detection & response playbook

Backdoor / remote access

  1. Find it

    Search your lockfiles and build artifacts for rgx33-css-grid-utils (version 1.0.0).

  2. If you installed it — respond

    rgx33-css-grid-utils establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

  3. Did it already run?

    If rgx33-css-grid-utils was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. rgx33-css-grid-utils on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-020958

References

Credits

  • Amazon Inspector · finder

Detect & block this

O3 blocks rgx33-css-grid-utils-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
rgx33-css-grid-utils (npm) malicious package — MAL-2026-17520 | O3 Security