MAL-2026-17530 Malicious code in wcag-color-a11y-helpers (npm)

Package is advertised as a WCAG color accessibility helper library but ships thunderboltRegistry.js, an IIFE that on module load executes shell commands (whoami, id, pwd, ifconfig/ip addr, hostname) and transmits the output via HTTP GET and DNS subdomain lookups to the hardcoded Burp Collaborator host gzjsunzfc6i9od2ouhb6dl4a61cs0qof.oastify.com, along with node/platform/pid metadata and an 'rce-poc' beacon string. The package exports factory functions under names mirroring Wix Thunderbolt internal registries (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, autoCompleteRegistry, thunderboltBuilderRegistry, thunderboltPreviewRegistry), and ships a registry-manifest.min.json that maps all of those registry names to thunderboltRegistry.js — a dependency-confusion/typosquat shape against Wix's @wix/thunderbolt-* internal registries. Any consumer that resolves one of these names loads and executes the recon/exfiltration payload. The a11y naming is a cover story unrelated to the actual code.