a11y-tabindex-manager
Manage tabindex attributes for accessible navigation
This report shows the evidence for a11y-tabindex-manager@1.0.0, the only known version.
AI Security Review
scanned 20d ago · by lpm-firewall-aiInspected source implements concrete data collection and transmission unrelated to accessibility management. The attack activates when the registry asset is evaluated, despite the absence of an installation hook.
Decision evidence
public snapshot- thunderboltRegistry.js immediately defines a sender that transmits collected data to a fixed external HTTP endpoint.
- The registry code runs a shell command to collect environment variables and forwards up to 2,000 characters.
- The registry code reads /etc/hosts through a shell command and forwards its contents; it also collects identity and network information.
- registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js file.
- The default index.js entrypoint exports an empty object, and package.json declares no lifecycle scripts; ordinary installation or default import does not activate the payload.
Source & flagged code
4 flagged · loading sourcethunderboltRegistry.js immediately defines a sender that transmits collected data to a fixed external HTTP endpoint.
thunderboltRegistry.jsView on unpkg · L2The registry code runs a shell command to collect environment variables and forwards up to 2,000 characters.
thunderboltRegistry.jsView on unpkg · L54The registry code reads /etc/hosts through a shell command and forwards its contents; it also collects identity and network information.
Findings
Affected versions and remediation
This report applies to a11y-tabindex-manager@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing a11y-tabindex-manager@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.