registry / css-env-function-shim / 1.0.0

css-env-function-shim@1.0.0

CSS env() function shim for legacy browsers

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The published registry script contains an active host reconnaissance and exfiltration payload. Its manifest provides a loading route despite the empty default entrypoint.

Static reason

No blocking static signals were detected.

Trigger

Loading thunderboltRegistry.js executes the payload immediately; command collection requires Node-compatible require and child_process, and transmission uses fetch.

Impact

Unconsented disclosure of host identity, system information, hosts file contents, and network configuration.

Mechanism

Encoded strings resolve to shell execution primitives and external destinations. Commands collect host information and requests transmit their output in query parameters and subdomains.

Attack narrative

When a consumer loads the registry script, its immediately invoked function decodes command execution identifiers, runs host reconnaissance commands, and sends results to external collection endpoints. It also emits beacons. The registry manifest points consumers to this executable script. The empty default entrypoint limits activation but does not neutralize the active payload.

AI rationale

Inspected source establishes automatic reconnaissance and external transmission when the published registry script loads. This behavior is unrelated to a CSS environment-function shim and supports blocking for data exfiltration.

Evidence

package.jsonregistry-manifest.min.jsonthunderboltRegistry.js/etc/hosts

Network endpoints2

webhook.site/0492a36c-4d7b-408a-865c-226db25987ba

Package self-describes as a CSS env() shim but ships thunderboltRegistry.js, which runs an IIFE at module load that base64-decodes the strings 'child_process' and 'execSync', dynamically requires child_process, and shells out whoami, uname, cat /etc/hosts, ifconfig/ip addr, id, and hostname. The collected output is POSTed to a hardcoded webhook.site URL (webhook.site/0492a36c-4d7b-408a-865c-226db25987ba) and beaconed to a subdomain of davdpb8lhot13kgmnhp0863x9g83mpswq.oast.live for DNS exfiltration. All sensitive identifiers (module name, method name, commands, destination host, UUID path, OAST subdomain) are stored as base64 blobs or String.fromCharCode arrays and reconstructed at runtime to defeat static inspection. index.js is a stub; the module factory is re-exported under nine Wix-internal registry key names (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, and similar), and the shipped registry-manifest.min.json aliases numerous Wix thunderbolt *Registry.js URLs on parastorage.com to this package's thunderboltRegistry.js — a dependency-confusion lure targeting Wix's internal build so that any importer of those names triggers the exfiltration IIFE at require time.

css-env-function-shim@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code