The npm package css-reading-display-polyfill version 1.0.0 contains embedded malicious code in thunderboltRegistry.js. A registry-manifest.min.json maps seven Wix thunderbolt and editor registry bundle names to this file via static.parastorage.com/unpkg so that Wix's renderer loads it. The file self-executes when loaded: it obtains child_process through sandbox-evasive fallbacks, runs id, uname, env, ifconfig and cat /etc/hosts via execSync, sends the output including up to 2000 characters of the process environment (credentials and tokens) to an attacker-controlled endpoint at webhook.site/69bcd627-1871-4dda-b880-83b37ceac418, sends an rce-poc beacon, and exports a Proxy stub of the Wix component-registry API so the host keeps running after the payload fires. This is a near-identical variant of the css-jptvix-polyfill payload and part of the same Wix-targeted dependency-confusion campaign.