MAL-2026-17486 Malicious code in css-scroll-state-polyfill (npm)

The package presents itself as a CSS polyfill but ships a payload file (thunderboltRegistry.js) that executes an IIFE at require time. The IIFE uses child_process to run host-identification commands (id, whoami, uname -a, ifconfig/ip addr, /etc/hosts, hostname) and collects Node version, platform, and PID, then sends the captured data via fetch to a hardcoded webhook.site collector at https://webhook.site/0492a36c-4d7b-408a-865c-226db25987ba. The main index.js is an empty stub; filenames mimic internal Wix Thunderbolt registry modules, consistent with a dependency-confusion squat targeting that namespace. A self-identifying 'beacon=poc15' tag is included in the request. The payload also walks require.cache and deletes any entry whose key contains 'thunderboltRegistry', causing subsequent requires in the same process to re-execute the recon-and-exfiltration path rather than return a cached export, and exports a Proxy that answers arbitrary method accesses to blend in with the impersonated registry.