MAL-2026-17517 Malicious code in popover-anchor-polyfill (npm)

The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that spawns shell commands via child_process.execSync (id, whoami, uname -a, ifconfig/ip addr) and reads /etc/hosts, then transmits each command's output together with hostname, Node version, platform, and pid over plain HTTP GET requests to the hardcoded endpoint http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. The require path uses cache-bypass tricks (deleting require.cache entries matching 'thunderboltRegistry' and manually constructing a fresh Module to re-resolve child_process) to defeat mocking or interception. Sibling stub files and a registry-manifest.min.json impersonate Wix thunderbolt internal registry names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry) and reference static.parastorage.com, indicating a dependency-confusion lure targeting Wix build pipelines. The declared polyfill purpose does not match the shipped Wix-internal namespace exports, and no popover-polyfill functionality is implemented.