registry / css-display-reading-polyfill / 1.0.0

css-display-reading-polyfill@1.0.0

Polyfill for CSS display reading order

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The manifest-selected bundle executes reconnaissance commands and exports host information to a fixed webhook upon evaluation.

Static reason

One or more suspicious static signals were detected.

Trigger

Loading payload.bundle.min.js directly or through either Thunderbolt manifest.

Impact

Discloses host identity, command output, and runtime information to an unrelated external recipient.

Mechanism

An immediately invoked function collects hostname and runtime details, executes identity and system commands when child_process is available, and sends results using fetch and HTTPS.

Attack narrative

A consumer loading the manifest-selected bundle activates an immediate reconnaissance routine. In Node environments it executes username, identity, and system-information commands, then sends their output and host details to a fixed webhook. The empty main entrypoint limits ordinary import activation but does not neutralize the executable payload exposed through both manifests.

AI rationale

Source proves automatic reconnaissance and external data transmission when the bundle is evaluated, unrelated to CSS reading-order functionality. The manifest loading paths make this executable attack behavior rather than an inert payload carrier.

Evidence

payload.bundle.min.jsrb_wixui.thunderbolt.manifest.min.jsonrb_dsgnsys.thunderbolt.manifest.min.json

Network endpoints1

webhook.site/5e52603d-f802-4a6f-b91b-43c3a5b45b6b

OSV advisory

The package ships payload.bundle.min.js, which on load runs an IIFE that invokes child_process.execSync to run id, whoami, and uname, collects os.hostname(), node version, process.platform, and pid, and transmits the results to the hardcoded collector https://webhook.site/5e52603d-f802-4a6f-b91b-43c3a5b45b6b via fetch and https.get. The published name impersonates an internal Wix thunderbolt module: shipped thunderbolt manifest JSON files declare this package as the loader entry for dozens of Wix component registry names (Container, StylableButton, MasterPage,...) and nine host registries (thunderboltRegistry, editorRegistry, corvidRegistry,...), with "shared":["payload.bundle.min.js"] and components mapped to that bundle. index.js is a benign stub; the exfil code lives entirely in the bundle, so any Wix runtime that resolves these internal registry names from this public package executes the host-reconnaissance payload. This is a dependency-confusion active attack: installer-side shell command output and host identifiers are sent to an attacker-controlled, non-first-party endpoint.

css-display-reading-polyfill@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code