registry / css-light-dark-polyfill / 1.0.0

css-light-dark-polyfill@1.0.0

Polyfill for CSS light-dark() color function

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The published registry module automatically collects host information and sends it to an external callback. Its registry manifest supplies URLs for loading that module.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Loading thunderboltRegistry.js in an environment supporting its Node.js APIs and fetch.

Impact

Exposes hostname, user identity, system and network details, and /etc/hosts contents.

Mechanism

An immediately invoked function executes shell commands, reads host information, and sends the results in callback query parameters.

Attack narrative

Loading the registry module immediately runs host reconnaissance commands and forwards their results to a fixed external callback. The manifest directs several registry names to this payload. Although the default package entrypoint is empty, the published registry module contains active data collection and transmission unrelated to CSS color polyfilling.

AI rationale

Inspected source establishes automatic host-data exfiltration through the registry module. The empty default entrypoint limits activation but does not neutralize the published executable payload.

Evidence

thunderboltRegistry.jsregistry-manifest.min.json/etc/hosts

Network endpoints1

dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f

OSV advisory

The package presents itself as a trivial CSS polyfill (index.js exports an empty object) but ships thunderboltRegistry.js, which on load runs a self-invoking IIFE that collects host identifiers (os.hostname, node version, platform, pid) and the output of local shell commands (id, whoami, uname -a, ifconfig/ip addr, /etc/hosts via child_process.execSync) and POSTs each result via fetch() to the hardcoded endpoint https://dxpoc.gt.tc/callback.php/. The payload self-labels as 'beacon=rce-poc'. The package also exports factories under the names of internal Wix Thunderbolt build registries (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, etc.), and a bundled registry-manifest.min.json maps those names to parastorage.com URLs — a dependency-confusion shape targeting Wix-like build systems that resolve these internal registry module names. Installing or loading this package causes host reconnaissance data to be exfiltrated to an attacker-controlled domain unrelated to any CSS polyfill functionality.

css-light-dark-polyfill@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code