registry / wix-ssr-thunderbolt-grid-polyfill / 0.1.0

wix-ssr-thunderbolt-grid-polyfill@0.1.0

Security research PoC - Wix SSR manifest injection test

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The Wix manifest loads bundles that contact a fixed external webhook. The model gathers host and runtime data, probes localhost services, and sends results to that receiver.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Loading the Wix manifest's model or bootstrap bundles.

Impact

Host and local service information is disclosed to an external receiver.

Mechanism

The model collects process and network-interface details, reads local network configuration, scans common localhost ports, and posts results to webhook.site. The bootstrap bundle also sends requests to that host.

Attack narrative

When the Wix manifest loads its model and bootstrap bundles, they run requests to a fixed webhook.site receiver. The model gathers runtime and host details, reads local network configuration, and probes common localhost ports before sending collected results. This creates an active host data exfiltration path.

AI rationale

The manifest activates bundles that collect host and local service information and send data to a fixed external receiver. This is active data exfiltration, so the package is malicious.

Evidence

rb_wixui.thunderbolt.manifest.min.jsondist/poc-model.bundle.min.jsdist/poc-bootstrap.bundle.min.js

Network endpoints2

webhook.site/69bcd627-1871-4dda-b880-83b37ceac418127.0.0.1

OSV advisory

The package ships two minified bundles — dist/poc-model.bundle.min.js and dist/poc-bootstrap.bundle.min.js — that are wired as the model and bootstrap batches in rb_wixui.thunderbolt.manifest.min.json under baseURL https://static.parastorage.com/unpkg/wix-ssr-thunderbolt-grid-polyfill@0.1.0/dist/. When the manifest resolves inside a Wix Thunderbolt SSR worker, poc-model.bundle.min.js collects Node version, cwd, hostname, POD_IP, uid, os.networkInterfaces() output, the contents of /etc/hosts and /etc/resolv.conf, environment variable names, a DNS lookup of bo.wix.com, and the response bodies of a localhost port scan across 40+ ports (including 80, 443, 3000), and POSTs the aggregate via https.request to https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418. poc-bootstrap.bundle.min.js issues companion fetch and https.request beacons to the same webhook.site URL with src=ssr-bootstrap tags. The package has no legitimate Wix SSR polyfill functionality; its sole shipped behavior is host, filesystem, network, and internal-service reconnaissance against the SSR environment, exfiltrated to an attacker-controlled webhook. The self-label 'Security research PoC' does not change the behavior — the destination is a non-first-party collector and the data read includes credential-adjacent SSR internals.

wix-ssr-thunderbolt-grid-polyfill@0.1.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code