css-gap-decorations-polyfill
Polyfill for CSS gap decorations proposal
This report shows the evidence for css-gap-decorations-polyfill@1.0.0, the only known version.
AI Security Review
scanned 19d ago · by lpm-firewall-aiInspected source establishes automatic host-data collection and external transmission unrelated to CSS polyfilling. The empty default entrypoint and absence of install hooks limit activation but do not neutralize the executable registry payload.
Decision evidence
public snapshot- Loading thunderboltRegistry.js immediately runs host reconnaissance commands and forwards their output.
- The module sends collected data through fetch to a fixed unrelated HTTP endpoint.
- The module reads /etc/hosts through a shell command and transmits up to 2,000 characters.
- registry-manifest.min.json maps registry module names to the executable payload.
- package.json explicitly includes the registry manifest and payload in published files.
- The default index.js entrypoint exports an empty object.
- package.json has no install lifecycle hooks; activation requires loading the registry module.
Source & flagged code
5 flagged · loading sourcepackage.json explicitly includes the registry manifest and payload in published files.
package.jsonView on unpkg · L5registry-manifest.min.json maps registry module names to the executable payload.
registry-manifest.min.jsonView on unpkg · L2The module sends collected data through fetch to a fixed unrelated HTTP endpoint.
thunderboltRegistry.jsView on unpkg · L11Loading thunderboltRegistry.js immediately runs host reconnaissance commands and forwards their output.
thunderboltRegistry.jsView on unpkg · L23The module reads /etc/hosts through a shell command and transmits up to 2,000 characters.
thunderboltRegistry.jsView on unpkg · L38Findings
Affected versions and remediation
This report applies to css-gap-decorations-polyfill@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing css-gap-decorations-polyfill@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.