css-ayucyz-polyfill@1.0.0

On require, thunderboltRegistry.js runs an IIFE that acquires child_process via multiple fallbacks and executes shell commands (id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts), then GETs the collected output along with the hostname, platform and Node version to the hardcoded plain-HTTP endpoint http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f. One of the beacons is self-labeled beacon=rce-poc. The package presents itself as a CSS polyfill and exposes modules named thunderboltRegistry, siteAssetsRegistry, editorRegistry and corvidRegistry — internal Wix Thunderbolt names — behind a Proxy returning no-op functions, with registry-manifest.min.json pointing fake entries at a static.parastorage.com URL, so a consumer that resolves this package in place of the real Wix internals loads the exfiltration IIFE while the facade silently returns no-ops.