If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d0ffba65f80ee8f200199c8c90ebb6297b8590537c80ea50bb34874d91665b5f)
The package ships thunderboltRegistry.js which imports child_process and invokes execSync with curl commands at multiple sites (lines 30, 39, 47, 48). The declared purpose of the package is a CSS logical-property shim, which has no legitimate need to spawn shells or make outbound curl requests. The co-location of child_process + repeated execSync('curl...') calls in a package whose stated purpose is a frontend CSS polyfill is the shape of a dropper or exfiltration helper rather than library code, and the file name 'thunderboltRegistry' is unrelated to any CSS functionality.