If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (d8c7540d3981f510255434529f76a2ed9a24b0783e7e8e3369b41f71b93ebd1a)
On require, thunderboltRegistry.js runs an IIFE that acquires child_process via multiple fallbacks and executes shell commands (id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts), then GETs the collected output along with the hostname, platform and Node version to the hardcoded plain-HTTP endpoint http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f. One of the beacons is self-labeled beacon=rce-poc. The package presents itself as a CSS polyfill and exposes modules named thunderboltRegistry, siteAssetsRegistry, editorRegistry and corvidRegistry — internal Wix Thunderbolt names — behind a Proxy returning no-op functions, with registry-manifest.min.json pointing fake entries at a static.parastorage.com URL, so a consumer that resolves this package in place of the real Wix internals loads the exfiltration IIFE while the facade silently returns no-ops.