registry / css-gap-decorations-polyfill / 1.0.0

css-gap-decorations-polyfill@1.0.0

Polyfill for CSS gap decorations proposal

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The shipped registry module automatically collects and transmits host information when loaded. Its registry manifest exposes the module under several registry names.

Static reason

No blocking static signals were detected.

Trigger

Loading thunderboltRegistry.js directly or through a consumer of the registry manifest.

Impact

Exposes the executing user's identity, operating system, network interfaces, hosts file contents, and process metadata.

Mechanism

A top-level function invokes child_process commands and sends encoded results through fetch to a fixed HTTP callback.

Attack narrative

The package ships an empty default entrypoint alongside a registry module containing an immediately executed collection routine. Loading that module runs host reconnaissance commands and transmits their output to a fixed external callback. The accompanying manifest maps several registry names to this module. Execution depends on that module being loaded and available runtime capabilities, but the payload is active code rather than an inert carrier.

AI rationale

Inspected source establishes automatic host-data collection and external transmission unrelated to CSS polyfilling. The empty default entrypoint and absence of install hooks limit activation but do not neutralize the executable registry payload.

Evidence

package.jsonregistry-manifest.min.jsonthunderboltRegistry.js/etc/hosts

Network endpoints1

dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3

The package is published as a CSS polyfill but ships no polyfill functionality. On require(), thunderboltRegistry.js uses child_process.execSync to run whoami, uname -a, ifconfig/ip addr, and read /etc/hosts, then sends each result along with a beacon (node version, platform, pid) as query parameters to the hardcoded attacker-controlled endpoint http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. The package exposes stub factories under internal-sounding names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, and others) and bundles a registry-manifest.min.json mapping them all to a single parastorage.com asset, consistent with a dependency-confusion attack targeting a private Wix/Thunderbolt package namespace. Installer harm: host identity, kernel version, network configuration, and /etc/hosts contents are exfiltrated to an attacker-controlled host simply by resolving and loading the package.

css-gap-decorations-polyfill@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code