GCVE-110-OSM-2026-13295

On require, thunderboltRegistry.js runs an immediately-invoked function that uses child_process.execSync to collect host identity and network reconnaissance from the installer's machine (`id`, `whoami`, `uname -a`, `ifconfig`/`ip addr`, and `/etc/hosts`), plus hostname, Node.js version, platform and pid, and transmits each result via fetch to the hardcoded plain-HTTP endpoint http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f. The package also exports Proxy stubs named thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry and ships a registry-manifest.min.json referencing parastorage.com, mimicking internal Wix thunderbolt build modules so the module auto-loads inside a Wix build and executes the reconnaissance payload. A CSS polyfill has no functional reason to execute shell commands, read /etc/hosts, or contact an external host. ENTRY index.js (main: index.js) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in thunderboltRegistry.js: "encodeURIComponent(site)).catch(function(){}); } catch(e" - System Information Collection in thunderboltRegistry.js: "process.platform" ADDITIONAL FINDINGS - Shell Command Execution in thunderboltRegistry.js: "require("child_process")" - Brand New Package - Very New NPM Publisher Account - Publisher Has Other Malicious Packages PAYLOAD FILES thunderboltRegistry.js