MSC-2026-12685

The npm package wix-ssr-thunderbolt-grid-polyfill version 0.1.0 contains embedded malicious code. It ships forged Wix Thunderbolt registry manifests rbwixui and rbdsgnsys that point the wixui namespace at this package's dist directory through Wix's static.parastorage.com unpkg mirror, so Wix...

Malicious code in css-gwqyid-polyfill (npm)

Source: amazon-inspector 3a81a389193175e49648e711d4eb83ebcbbd0b51e1b7a6677ceb338c3398dc19 thunderboltRegistry.js executes an IIFE on module load that collects host reconnaissance id, whoami, full process environment via env, and ifconfig/ip addr output and sends each result as a GET query-string ...

Malicious code in css-nrmgzn-polyfill (npm)

Source: amazon-inspector 4522148c469356aa7799c831ce547d2ae612ac40621e5110ad5d5125bf2f2684 The package presents itself as a CSS polyfill but on require of thunderboltRegistry.js runs an IIFE that invokes childprocess.execSync for id, whoami, uname, ifconfig, and cat /etc/hosts, and sends the comma...

Malicious code in css-eqxcdx-polyfill (npm)

Source: amazon-inspector a93fe0298f7671177e324947b2bf89ec3729b203621f7ca67aa8cd10439306a2 The package presents itself as a polyfill exporting Wix thunderbolt-style registry stubs thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, etc., but...

Malicious code in css-kfvwax-polyfill (npm)

Source: amazon-inspector 2041e61cd16558aaaeac8a2f26024866a6b949d93817f78de744c5c1781023df On require, thunderboltRegistry.js runs an IIFE that shells out via childprocess to collect host identity id, whoami, uname -a, network interface listings ifconfig/ip addr, and the contents of /etc/hosts,...

Malicious code in css-nrmgzn-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4522148c469356aa7799c831ce547d2ae612ac40621e5110ad5d5125bf2f2684 The package presents itself as a CSS polyfill but on require of thunderboltRegistry.js runs an IIFE that invokes childprocess.execSync for id, whoami...

MAL-2026-17576 Malicious code in css-nrmgzn-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4522148c469356aa7799c831ce547d2ae612ac40621e5110ad5d5125bf2f2684 The package presents itself as a CSS polyfill but on require of thunderboltRegistry.js runs an IIFE that invokes childprocess.execSync for id, whoami...

MAL-2026-17573 Malicious code in css-eqxcdx-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a93fe0298f7671177e324947b2bf89ec3729b203621f7ca67aa8cd10439306a2 The package presents itself as a polyfill exporting Wix thunderbolt-style registry stubs thunderboltRegistry, siteAssetsRegistry,...

Malicious code in css-kfvwax-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2041e61cd16558aaaeac8a2f26024866a6b949d93817f78de744c5c1781023df On require, thunderboltRegistry.js runs an IIFE that shells out via childprocess to collect host identity id, whoami, uname -a, network interface...

MAL-2026-17575 Malicious code in css-kfvwax-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2041e61cd16558aaaeac8a2f26024866a6b949d93817f78de744c5c1781023df On require, thunderboltRegistry.js runs an IIFE that shells out via childprocess to collect host identity id, whoami, uname -a, network interface...

Malicious code in css-gwqyid-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a81a389193175e49648e711d4eb83ebcbbd0b51e1b7a6677ceb338c3398dc19 thunderboltRegistry.js executes an IIFE on module load that collects host reconnaissance id, whoami, full process environment via env, and ifconfig/i...

MAL-2026-17574 Malicious code in css-gwqyid-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a81a389193175e49648e711d4eb83ebcbbd0b51e1b7a6677ceb338c3398dc19 thunderboltRegistry.js executes an IIFE on module load that collects host reconnaissance id, whoami, full process environment via env, and ifconfig/i...

Malicious code in ph-common (npm)

Source: amazon-inspector f82053e651a1ec7ee7cdf8ecd57ca4be012f7ce8d60dec081f99c2b80cb66bf2 The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, so consumers that import it receive a non-functional module. The only functional code is beacon.cjs,...

Malicious code in css-txedrf-polyfill (npm)

Source: amazon-inspector 7d70c660ff3138360df0239fc6ef3db7beaca61ca069bc2d108ed893c68acb63 thunderboltRegistry.js executes an IIFE at require time that runs OS reconnaissance commands id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts via childprocess.execSync, URL-encodes the output together...

Malicious code in css-svqggc-polyfill (npm)

Source: amazon-inspector 6b23cf39720388bcf9f26621bd52e256e18a011bf3b6821b7d9f5f60115b9663 Package masquerades as a CSS polyfill while impersonating internal Wix Thunderbolt registry modules thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, and other namespace stubs, with a...

Malicious code in css-mpmdds-polyfill (npm)

Source: amazon-inspector 4bac0cb0a2c693985668a890ff2ace72ff2d00dac60bc5470a77160c4d765106 The package presents itself as a CSS polyfill but ships thunderboltRegistry.js which runs an IIFE at module load. The IIFE acquires childprocess via multiple fallbacks require'childprocess',...

Malicious code in css-nbanqq-polyfill (npm)

Source: amazon-inspector 7377a70c94f8fd1719147b2023860926935a70410f672e07411326284f11a69f The package impersonates Wix thunderbolt internal registry modules exporting thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, etc. and shipping a registry-manifest.min.json referencin...

Malicious code in css-display-reading-polyfill (npm)

Source: amazon-inspector b397798b7209f1094c33dc3ed721d4a3ef0536065317bd06bae76e33dd505334 The package ships payload.bundle.min.js, which on load runs an IIFE that invokes childprocess.execSync to run id, whoami, and uname, collects os.hostname, node version, process.platform, and pid, and transmi...

Malicious code in css-hgwctv-polyfill (npm)

Source: amazon-inspector ee1103a16c6f933686f07e8ce94068057f49e5cf2f0a6a9ccf01f2baeb7cfe95 On require, thunderboltRegistry.js runs an immediately-invoked function that uses childprocess.execSync to collect host identity and network reconnaissance from the installer's machine id, whoami, uname -a,...

Malicious code in css-dwsawd-polyfill (npm)

Source: amazon-inspector 1c370cda09695e44d06a44bc14d14817edadc047e4dad0314edcfc752be796e9 The package name mimics a Wix thunderbolt polyfill and ships a registry-manifest.min.json that aliases legitimate @wix thunderbolt registry module names to thunderboltRegistry.js. On require,...