The npm package wix-ssr-thunderbolt-grid-polyfill version 0.1.0 contains embedded malicious code. It ships forged Wix Thunderbolt registry manifests (rb_wixui and rb_dsgnsys) that point the wixui namespace at this package's dist directory through Wix's static.parastorage.com unpkg mirror, so Wix server-side rendering workers load the attacker bundles. On load, dist/poc-bootstrap.bundle.min.js sends an execution beacon and dist/poc-model.bundle.min.js performs internal network reconnaissance: a localhost port scan of about 40 ports with HTTP banner grabbing, reading /etc/hosts and /etc/resolv.conf, collecting network interfaces, pod IP, user id and environment variable names, and resolving bo.wix.com. The collected data is sent to an attacker-controlled endpoint at webhook.site/69bcd627-1871-4dda-b880-83b37ceac418. This is a dependency-confusion style supply-chain attack targeting Wix infrastructure, part of the same campaign as css-jptvix-polyfill, css-reading-display-polyfill and css-flow-render-shim.