registry / css-flow-render-shim / 1.0.0

css-flow-render-shim@1.0.0

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The shipped bundle contains code that collects command output and sends it to a fixed webhook.site endpoint when the bundle is loaded. The package main entry point does not load that bundle.

Static reason

One or more suspicious static signals were detected.

Trigger

Directly loading payload.bundle.min.js.

Impact

A consumer that loads the bundle could disclose local system and environment information to the remote endpoint; the package entry point alone does not trigger this behavior.

Mechanism

The bundle runs system commands, reads environment and host information, and sends the collected output and a runtime beacon to webhook.site.

AI rationale

The bundle contains a concrete command-output collection and network-send path, but the declared package entry point does not load it. This is a suspicious shipped payload rather than a confirmed attack through the package's normal entry point.

Evidence

payload.bundle.min.js

Network endpoints1

webhook.site/69bcd627-1871-4dda-b880-83b37ceac418

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-17655

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in css-flow-render-shim (npm)

The package publishes an empty index.js stub but ships Thunderbolt manifests that register payload.bundle.min.js as the bundle for core Wix components across the thunderbolt/wixui and thunderbolt/dsgnsys namespaces (Container, MasterPage, Section, StylableButton, WRichText, and others), and the bundle exports factories under names like thunderboltRegistry, editorRegistry, and corvidRegistry. When a Wix Thunderbolt build pipeline resolves this name from the public registry instead of the intended internal package, payload.bundle.min.js is loaded and its top-level IIFE executes immediately. The IIFE uses child_process.execSync to run whoami, id, uname -a, env | head -100, ifconfig/ip addr, and cat /etc/hosts, then URL-encodes each output along with hostname, node version, platform, and pid and sends it via https.get to a hardcoded collector at https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418. The payload also iterates require.cache and deletes every entry whose path contains payload, rb_wixui, or rb_dsgnsys so the recon routine re-fires on each subsequent require within a long-running build process. The combination of a hollow public package impersonating an internal Wix shim, Thunderbolt-shaped manifests, host and environment reconnaissance via shell commands, exfiltration to an attacker-controlled webhook.site endpoint, and require.cache tampering is a dependency-confusion attack against Wix build systems.

css-flow-render-shim@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code