GCVE-110-OSM-2026-13323

The package ships thunderboltRegistry.js, which uses child_process and process.platform to collect host information and POSTs it via fetch() to the hardcoded external endpoint http://dxpoc.gt.tc. The destination is unrelated to any CSS polyfill functionality the package name advertises, is served over cleartext HTTP, and is not caller-configurable. This behavior does not correspond to the declared purpose of a CSS snap-target polyfill, which has no legitimate need to execute shell commands or beacon host details to a third-party domain. ENTRY index.js (main: index.js) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in thunderboltRegistry.js: "encodeURIComponent(site)).catch(function(){}); } catch(e" - System Information Collection in thunderboltRegistry.js: "process.platform" ADDITIONAL FINDINGS - Shell Command Execution in thunderboltRegistry.js: "require("child_process")" - Very New NPM Publisher Account - Publisher Has Other Malicious Packages PAYLOAD FILES thunderboltRegistry.js