The npm package css-flow-render-shim version 1.0.0 contains embedded malicious code in payload.bundle.min.js. Forged Wix Thunderbolt registry manifests (rb_wixui and rb_dsgnsys) bind core Wix components such as Container, BackgroundGroup and MasterPage to this payload with a base URL on unpkg.com, so Wix's renderer loads it. The payload self-executes when loaded: it obtains child_process through sandbox-evasive fallbacks, runs whoami, id, uname, env, ifconfig and cat /etc/hosts via execSync, sends the output including up to 2000 characters of the process environment to an attacker-controlled endpoint at webhook.site/69bcd627-1871-4dda-b880-83b37ceac418, sends a topology-rce beacon, and exports a Proxy stub of the Wix component-registry API. Same payload family and exfiltration endpoint as css-reading-display-polyfill and wix-ssr-thunderbolt-grid-polyfill; part of the Wix-targeted dependency-confusion campaign.