MSC-2026-12686

The npm package css-flow-render-shim version 1.0.0 contains embedded malicious code in payload.bundle.min.js. Forged Wix Thunderbolt registry manifests rbwixui and rbdsgnsys bind core Wix components such as Container, BackgroundGroup and MasterPage to this payload with a base URL on unpkg.com, so...