The npm package css-jptvix-polyfill version 1.0.0 contains embedded malicious code in thunderboltRegistry.js. The file self-executes when loaded: it runs id, whoami, env and ifconfig via child_process.execSync, sends the full process environment (including any credentials and tokens) to an attacker-controlled out-of-band host (orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com), downloads a second-stage script from appsecc.com and executes it with node (labelled reverse-shell in the code), and sends an RCE beacon. A bundled registry-manifest.min.json maps Wix thunderbolt and editor registry bundle names to this file via static.parastorage.com/unpkg, and the module exports a Proxy stub of the Wix component-registry API so the host keeps running after the payload fires. This is a dependency-confusion style supply-chain attack disguised as a CSS polyfill. The package has no legitimate functionality and was removed from npm.