{"id":"MAL-2026-19225","kind":"package","aliases":["MAL-2026-19225"],"related":[],"title":"Malicious code in math-helpers-extra-utils (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cc75601c6416f2ac62b69fb197e0338f1e9a878fe15e83a48fc25c9aea8bbe55)\nmath-helpers-extra-utils@1.0.0 is advertised as 'Extra math helper utilities' and ships an empty index.js, but also includes thunderboltRegistry.js which registers factories under Wix-internal registry names (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, dataBindingRegistry, thunderboltBuilderRegistry, thunderboltPreviewRegistry) and a manifest referencing https://static.parastorage.com/unpkg/math-helpers-extra-utils@1.0.0/. When loaded via Wix's dynamic registry loader, a top-level IIFE in thunderboltRegistry.js executes child_process.execSync for `id`, `hostname`, and `uname -a`, collects platform, pid, and Node version, and issues a GET with those fields to the hardcoded third-party collector https://webhook.site/0492a36c-4d7b-408a-865c-226db25987ba. The declared package name is unrelated to Wix thunderbolt, and the registry-name hijack is the mechanism by which the exfiltration payload is reached — a dependency-confusion shape targeting Wix's internal build pipeline, with host reconnaissance of the building environment sent off-host.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"math-helpers-extra-utils","fixed":[],"affected":"= 1.0.1; = 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T03:56:21+00:00","first_seen_at":"2026-11-13T05:11:56+00:00","triaged_at":"2026-11-13T05:12:56+00:00","updated_at":"2026-11-13T05:14:00+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19225':12A,15A '-2026':11A,14A '/0492a36c-4d7b-408a-865c-226db25987ba.':127C '/unpkg/math-helpers-extra-utils@1.0.0/.':81C '1.0.0':42C 'advertis':44C 'also':56C 'amazon':34C 'amazon-inspector':33C 'build':162C,169C 'cc75601c6416f2ac62b69fb197e0338f1e9a878fe15e83a48fc25c9aea8bbe55':36C 'child_process.execsync':98C 'code':2A 'collect':105C 'collector':124C 'confus':156C 'corvidregistri':71C 'databindingregistri':72C 'declar':129C 'depend':155C 'dependency-confus':154C 'detail':25C 'dynam':87C 'edit':28C 'editorregistri':70C 'empti':53C 'environ':170C 'execut':97C 'exfiltr':149C 'extra':7A,19A,40C,46C 'factori':61C 'field':117C 'get':114C 'hardcod':120C 'helper':6A,39C,48C 'helpers':18A 'hijack':142C 'host':165C,174C 'hostnam':101C 'id':100C 'iif':94C 'includ':57C 'index.js':54C 'inspector':35C 'intern':65C,161C 'issu':112C 'level':93C 'line':31C 'load':83C 'loader':89C 'mal':10A,13A 'malici':1A,21B 'manifest':77C 'math':5A,17A,38C,47C 'math-helpers-extra-util':4A,37C 'math-helpers-extra-utils':16A 'mechan':145C 'name':67C,131C,141C 'node':109C 'npm':9A 'off-host':172C 'packag':22B,130C 'parti':123C 'payload':150C 'per':23C 'pid':107C 'pipelin':163C 'platform':106C 'reach':152C 'reconnaiss':166C 'referenc':78C 'regist':60C 'registri':66C,88C,140C 'registry-nam':139C 'sent':171C 'shape':157C 'ship':51C 'siteassetsregistri':69C 'sourc':24C,32C 'static.parastorage.com':80C 'static.parastorage.com/unpkg/math-helpers-extra-utils@1.0.0/.':79C 'target':158C 'third':122C 'third-parti':121C 'thunderbolt':136C 'thunderboltbuilderregistri':73C 'thunderboltpreviewregistri':74C 'thunderboltregistri':68C 'thunderboltregistry.js':58C,96C 'top':92C 'top-level':91C 'unam':103C 'unrel':133C 'util':8A,41C,49C 'utils':20A 'version':110C 'via':84C 'webhook.site':126C 'webhook.site/0492a36c-4d7b-408a-865c-226db25987ba.':125C 'wix':64C,85C,135C,159C 'wix-intern':63C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["mathhelpersextrautils"],"ptokens":["extra","helpers","math","utils"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"search_a":"'-19225':12A,15A '-2026':11A,14A 'code':2A 'extra':7A,19A 'helper':6A 'helpers':18A 'mal':10A,13A 'malici':1A 'math':5A,17A 'math-helpers-extra-util':4A 'math-helpers-extra-utils':16A 'npm':9A 'util':8A 'utils':20A","search_b":"'malici':21B 'packag':22B","search_c":"'/0492a36c-4d7b-408a-865c-226db25987ba.':127C '/unpkg/math-helpers-extra-utils@1.0.0/.':81C '1.0.0':42C 'advertis':44C 'also':56C 'amazon':34C 'amazon-inspector':33C 'build':162C,169C 'cc75601c6416f2ac62b69fb197e0338f1e9a878fe15e83a48fc25c9aea8bbe55':36C 'child_process.execsync':98C 'collect':105C 'collector':124C 'confus':156C 'corvidregistri':71C 'databindingregistri':72C 'declar':129C 'depend':155C 'dependency-confus':154C 'detail':25C 'dynam':87C 'edit':28C 'editorregistri':70C 'empti':53C 'environ':170C 'execut':97C 'exfiltr':149C 'extra':40C,46C 'factori':61C 'field':117C 'get':114C 'hardcod':120C 'helper':39C,48C 'hijack':142C 'host':165C,174C 'hostnam':101C 'id':100C 'iif':94C 'includ':57C 'index.js':54C 'inspector':35C 'intern':65C,161C 'issu':112C 'level':93C 'line':31C 'load':83C 'loader':89C 'manifest':77C 'math':38C,47C 'math-helpers-extra-util':37C 'mechan':145C 'name':67C,131C,141C 'node':109C 'off-host':172C 'packag':130C 'parti':123C 'payload':150C 'per':23C 'pid':107C 'pipelin':163C 'platform':106C 'reach':152C 'reconnaiss':166C 'referenc':78C 'regist':60C 'registri':66C,88C,140C 'registry-nam':139C 'sent':171C 'shape':157C 'ship':51C 'siteassetsregistri':69C 'sourc':24C,32C 'static.parastorage.com':80C 'static.parastorage.com/unpkg/math-helpers-extra-utils@1.0.0/.':79C 'target':158C 'third':122C 'third-parti':121C 'thunderbolt':136C 'thunderboltbuilderregistri':73C 'thunderboltpreviewregistri':74C 'thunderboltregistri':68C 'thunderboltregistry.js':58C,96C 'top':92C 'top-level':91C 'unam':103C 'unrel':133C 'util':41C,49C 'version':110C 'via':84C 'webhook.site':126C 'webhook.site/0492a36c-4d7b-408a-865c-226db25987ba.':125C 'wix':64C,85C,135C,159C 'wix-intern':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T03:56:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19225","url":"https://osv.dev/vulnerability/MAL-2026-19225","severity":"critical","published_at":"2026-11-13T03:56:21+00:00","modified_at":"2026-11-13T04:30:07+00:00","first_seen_at":"2026-11-13T05:11:56+00:00","fetched_at":"2026-11-13T05:11:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}