MAL-2026-19225: Malicious code in math-helpers-extra-utils (npm)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (cc75601c6416f2ac62b69fb197e0338f1e9a878fe15e83a48fc25c9aea8bbe55) math-helpers-extra-utils@1.0.0 is advertised as 'Extra math helper utilities' and ships an empty index.js, but also includes thunderboltRegistry.js which registers factories under Wix-internal registry names (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, thunderboltBuilderRegistry, thunderboltPreviewRegistry) and a manifest referencing https://static.parastorage.com/unpkg/math-helpers-extra-utils@1.0.0/. When loaded via Wix's dynamic registry loader, a top-level IIFE in thunderboltRegistry.js executes childprocess.execSync for id, hostname, and uname -a, collects platform, pid, and Node version, and issues a GET with those fields to the hardcoded third-party collector https://webhook.site/0492a36c-4d7b-408a-865c-226db25987ba. The declared package name is unrelated to Wix thunderbolt, and the registry-name hijack is the mechanism by which the exfiltration payload is reached — a dependency-confusion shape targeting Wix's internal build pipeline, with host reconnaissance of the building environment sent off-host.
Affected Software
Event History
Frequently Asked Questions
Which environments are realistically exposed?
Exposure is tied to Wix environments that load the package through Wix's dynamic registry loader. The package registers factories under Wix-internal registry names, so merely using its advertised math-helper interface is not the described execution path.
What must occur for the reconnaissance code to run?
The thunderboltRegistry.js file must be loaded through the Wix dynamic registry loader. Its top-level IIFE then runs automatically and invokes child_process.execSync.
What information is collected and where is it sent?
The code runs id, hostname, and uname -a, and also collects platform, process ID, and Node version. It sends these values in a GET request to https://webhook.site/0492a36c-4d7b-408a-865c-226db25987ba.
How can responders look for evidence of execution?
Review outbound HTTP logs for requests to webhook.site/0492a36c-4d7b-408a-865c-226db25987ba. On affected build or runtime hosts, also look for execution of id, hostname, and uname -a associated with Node processes loading thunderboltRegistry.js.