{"id":"MAL-2026-17655","summary":"Malicious code in css-flow-render-shim (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f008c8756b09bb1840b05eafe5a30432475f6cc2d5a10064a42920059e8784fd)\nThe package publishes an empty index.js stub but ships Thunderbolt manifests that register payload.bundle.min.js as the bundle for core Wix components across the thunderbolt/wixui and thunderbolt/dsgnsys namespaces (Container, MasterPage, Section, StylableButton, WRichText, and others), and the bundle exports factories under names like thunderboltRegistry, editorRegistry, and corvidRegistry. When a Wix Thunderbolt build pipeline resolves this name from the public registry instead of the intended internal package, payload.bundle.min.js is loaded and its top-level IIFE executes immediately. The IIFE uses child_process.execSync to run whoami, id, uname -a, env | head -100, ifconfig/ip addr, and cat /etc/hosts, then URL-encodes each output along with hostname, node version, platform, and pid and sends it via https.get to a hardcoded collector at https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418. The payload also iterates require.cache and deletes every entry whose path contains payload, rb_wixui, or rb_dsgnsys so the recon routine re-fires on each subsequent require within a long-running build process. The combination of a hollow public package impersonating an internal Wix shim, Thunderbolt-shaped manifests, host and environment reconnaissance via shell commands, exfiltration to an attacker-controlled webhook.site endpoint, and require.cache tampering is a dependency-confusion attack against Wix build systems.\n","modified":"2026-10-08T04:00:04.226709224Z","published":"2026-10-08T03:38:22Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-10-08T03:38:22Z","sha256":"f008c8756b09bb1840b05eafe5a30432475f6cc2d5a10064a42920059e8784fd","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-021116","import_time":"2026-10-08T03:50:28.94437226Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/css-flow-render-shim/v/1.0.0"}],"affected":[{"package":{"name":"css-flow-render-shim","ecosystem":"npm","purl":"pkg:npm/css-flow-render-shim"},"versions":["1.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"2579c09d078991532f03cec0d53c7182ea1426a0faf465d7a9a93827b247578e","tlsh":"f78111a5a998b021a5c37478cb7f904ef4bb96632c6c6ed4b44c8ab12f3185c42b95f0","path":"payload.bundle.min.js"},{"path":"rb_wixui.thunderbolt.manifest.min.json","sha256":"58554c599280f131f74397c7630b5ab297891c73544d8f33748cde5e2c78dfc6","tlsh":"f401a72681185d1a4e81393e31b3bf015d77a0a23d944f00c679d3de8fb96a170d2dc1"}],"package_integrity":[{"filename":"css-flow-render-shim-1.0.0.tgz","hashes":{"sha1":"447d4119f3ceefc6904f917fc3c0273ffa903ec5","sha512_sri":"sha512-P7PIzY9n/e0SxCSAjQZQ/weGm92XudY5G146tKrPpjATDSV8nkEyFobT2AcZUNAGxXiAS5VW3yQoBpDwMPeHcg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/css-flow-render-shim/MAL-2026-17655.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}