registry / css-field-sizing-polyfill / 1.0.0

css-field-sizing-polyfill@1.0.0

Polyfill for CSS field-sizing property

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The published registry module executes system reconnaissance and transmits results to an external endpoint when loaded. Its registry manifest exposes that module through several asset mappings.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Loading thunderboltRegistry.js in an environment with the relevant Node.js APIs and fetch available.

Impact

Discloses hostname, user identity, operating system and network information, and /etc/hosts contents.

Mechanism

An immediately invoked function runs shell commands, reads host information, and sends URL-encoded results through HTTP requests to a hardcoded recipient.

Attack narrative

A consumer loading one of the mapped registry assets executes the payload immediately. It collects system information with shell commands and sends the results, together with the hostname, to a hardcoded external HTTP endpoint. The empty default entrypoint limits activation but does not neutralize the executable module distributed through the registry manifest.

AI rationale

Inspected source proves automatic system-data exfiltration upon loading the published registry module, unrelated to CSS field sizing. The payload is executable attack code, although ordinary package import and installation do not trigger it.

Evidence

thunderboltRegistry.jsregistry-manifest.min.jsonpackage.json/etc/hosts

Network endpoints2

/callback.php/bb8968d0f67000433bf7005dd5ad2d1f

The package advertises itself as a CSS field-sizing polyfill but ships thunderboltRegistry.js, which runs an IIFE at module load time. The IIFE shells out via child_process.execSync to run `id`, `whoami`, `uname -a`, `ifconfig`/`ip addr`, and `cat /etc/hosts`, then transmits the collected output together with hostname, Node version, platform, and pid as query-string parameters to the hardcoded plaintext endpoint http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f. The module also exports proxied stubs for Wix-internal names (`thunderboltRegistry`, `siteAssetsRegistry`, `documentManagementRegistry`, `editorRegistry`, `corvidRegistry`) and ships a `registry-manifest.min.json` pointing at `static.parastorage.com`, indicating a dependency-confusion impersonation of Wix internal packages so that an internal resolver pulling this public name will trigger the beacon. The reconnaissance behavior is unrelated to the declared CSS polyfill purpose and fires on any `require()` of the package.

css-field-sizing-polyfill@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code