MalwarePublished 8 Oct 2026Updated 29 Oct 2026

css-overscroll-contain (npm) · Malicious Code

Affects css-overscroll-containSource GCVE Database

Malicious package : remove css-overscroll-contain and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:23 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17705

What to do

Remove css-overscroll-contain from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcss-overscroll-contain	Affected 1.0.0 – 1.0.3 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package css-overscroll-contain versions 1.0.0 through 1.0.3 contains malicious code that executes immediately upon module load. This code performs host reconnaissance, steals credentials and sensitive environment variables, probes container escape techniques, and exfiltrates data to a hardcoded attacker endpoint. The package masquerades as a CSS utility but is incompatible with legitimate functionality. Any system with this package installed should be considered fully compromised.

Impact

Systems with this package installed are fully compromised. The malware steals credentials, secrets, and sensitive system information, potentially allowing attackers to gain persistent and broad access. The presence of container escape attempts indicates risk of breaking out of containerized environments. Immediate credential rotation is necessary as all secrets on the affected system may be exposed. Removal of the package alone does not guarantee full remediation due to possible persistence mechanisms.

Defensive guidance

Remove the css-overscroll-contain package immediately from all affected systems. Rotate all secrets, tokens, and credentials that were stored or accessible on the compromised host from a separate, secure environment. Conduct a thorough investigation for additional persistence or backdoors, as the system should be considered fully compromised.

Summary

The css-overscroll-contain npm package (versions 1.0.0, 1.0.1, 1.0.2, and 1.0.3) contains a self-executing script that runs on module load. This script collects detailed host information including system identity, file descriptors, mount information, network and DNS data, environment variables containing secrets, and Kubernetes service-account tokens. It attempts container escape via unshare and memfd_create techniques. All collected data is sent to a hardcoded malicious endpoint. The package uses names and manifests consistent with Wix internal infrastructure to evade detection. The malicious behavior is incompatible with the advertised CSS overscroll utility purpose, indicating deliberate malware.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:23 UTC

Technical details

References

Community reviews