{"id":"MAL-2026-17664","revision":"e8f220a282364564b6c83f6ee3b18d60","records":[{"revision":"e8f220a282364564b6c83f6ee3b18d60","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17664","aliases":[],"title":"Malicious code in wix-ssr-thunderbolt-grid-polyfill (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b6e0013701f6ab53085883b09092f0cd5ae9aaaab51a9f0e9de5aa68946ae9e1)\nThe package ships two minified bundles — dist/poc-model.bundle.min.js and dist/poc-bootstrap.bundle.min.js — that are wired as the model and bootstrap batches in rb_wixui.thunderbolt.manifest.min.json under baseURL https://static.parastorage.com/unpkg/wix-ssr-thunderbolt-grid-polyfill@0.1.0/dist/. When the manifest resolves inside a Wix Thunderbolt SSR worker, poc-model.bundle.min.js collects Node version, cwd, hostname, POD_IP, uid, os.networkInterfaces() output, the contents of /etc/hosts and /etc/resolv.conf, environment variable names, a DNS lookup of bo.wix.com, and the response bodies of a localhost port scan across 40+ ports (including 80, 443, 3000), and POSTs the aggregate via https.request to https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418. poc-bootstrap.bundle.min.js issues companion fetch and https.request beacons to the same webhook.site URL with src=ssr-bootstrap tags. The package has no legitimate Wix SSR polyfill functionality; its sole shipped behavior is host, filesystem, network, and internal-service reconnaissance against the SSR environment, exfiltrated to an attacker-controlled webhook. The self-label 'Security research PoC' does not change the behavior — the destination is a non-first-party collector and the data read includes credential-adjacent SSR internals.\n","state":0,"publishedAt":"2026-10-08T03:37:53+00:00","modifiedAt":"2026-10-08T04:00:05.4286171+00:00","affected":[{"ecosystem":"npm","name":"wix-ssr-thunderbolt-grid-polyfill","ranges":[],"versions":["0.1.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/wix-ssr-thunderbolt-grid-polyfill/v/0.1.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17664","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17664","identifiers":["MAL-2026-17664"]},"retained":false,"historicalAffected":[]}],"coverage":[]}