Malicious code in css-jptvix-polyfill (npm)

The css-jptvix-polyfill package (version 1.0.0) includes a malicious module named thunderboltRegistry.js that exports proxies imitating Wix internal thunderbolt modules. When imported, it executes system commands such as 'id', 'whoami', 'env', and network interface queries, collecting environment variables and host information. This data is exfiltrated via an HTTP fetch request to a hardcoded Burp Collaborator subdomain. Additionally, the package runs a command to download and execute JavaScript from a third-party domain, enabling a reverse shell. The package is consistent with a dependency confusion attack designed to compromise Wix thunderbolt builds by injecting malicious code during installation or build processes.

The malicious code leaks sensitive environment information, including tokens and secrets, and host identifiers to an attacker-controlled server. It also enables remote code execution by downloading and running arbitrary JavaScript, potentially allowing full system compromise of the installer's machine.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the css-jptvix-polyfill package version 1.0.0 and audit dependencies for suspicious or unexpected packages. Remove or block this package from build and deployment pipelines to prevent execution of the malicious payload.