css-overscroll-contain
CSS overscroll-behavior containment polyfill
This report shows the evidence for css-overscroll-contain@1.0.3. 3 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 14d ago · by lpm-firewall-aiSource inspection confirms covert collection and transmission of host and potentially credential-bearing environment data from thunderboltRegistry.js. Although the declared main entry point is inert, the registry manifest exposes the malicious file under multiple registry names; this supports blocking publication.
Decision evidence
public snapshot- The manifest identifies index.js as the main entry point, while the registry manifest maps multiple registry names to thunderboltRegistry.js.
- Loading thunderboltRegistry.js runs shell commands and sends their output to a fixed webhook.site URL.
- The file collects environment variables matching credential-related terms and transmits the result.
- The declared main entry point, index.js, only exports an empty object; the malicious behavior requires loading thunderboltRegistry.js.
Source & flagged code
5 flagged · loading sourceThe manifest identifies index.js as the main entry point, while the registry manifest maps multiple registry names to thunderboltRegistry.js.
package.jsonView on unpkg · L1The manifest identifies index.js as the main entry point, while the registry manifest maps multiple registry names to thunderboltRegistry.js.
registry-manifest.min.jsonView on unpkg · L1Findings
Affected versions and remediation
This report applies to css-overscroll-contain@1.0.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing css-overscroll-contain@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.