registry / css-relative-color-util / 1.0.0

css-relative-color-util@1.0.0

CSS relative color syntax utility

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Loading thunderboltRegistry.js activates host reconnaissance and exports results to fixed external recipients. The bundled registry manifest exposes this executable module to registry loaders.

Static reason

One or more suspicious static signals were detected.

Trigger

Loading thunderboltRegistry.js directly or through a loader using registry-manifest.min.json.

Impact

Exposes the hostname, user identity, operating-system information, hosts-file content, and network configuration.

Mechanism

An immediately invoked function executes reconnaissance commands and sends output through HTTP requests and encoded DNS queries.

Attack narrative

The package bundles a registry module whose loading immediately gathers host information, runs shell reconnaissance commands, and exports results to fixed HTTP and DNS recipients. Its manifest maps several registry names to that module. Although the default entrypoint is inert, the shipped registry module contains active data-exfiltration behavior unrelated to CSS color utilities.

AI rationale

Inspected source establishes automatic reconnaissance and data export when the registry module loads. The inert default entrypoint limits activation but does not neutralize the executable payload.

Evidence

thunderboltRegistry.jsregistry-manifest.min.json/etc/hosts

Network endpoints2

dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1fdavdpb8lhot13kgmnhp0863x9g83mpswq.oast.live

The package name advertises a CSS utility, but thunderboltRegistry.js runs an IIFE on module load that uses child_process.execSync to execute whoami, uname -a, cat /etc/hosts, and ifconfig/ip addr, then exfiltrates the output together with os.hostname and the Node version to a hardcoded webhook at https://dxpoc.gt.tc/callback.php/ via fetch and to an *.oast.live DNS collector via dns.resolve. The loader deletes any require.cache entry containing 'thunderboltRegistry' so the IIFE re-fires on subsequent requires, and falls back to node:child_process and new module.constructor().require('child_process') to obtain the exec primitive. The package also exports stubs named thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry and similar, matching internal Wix thunderbolt module names, with a registry-manifest.min.json pointing at static.parastorage.com unpkg paths — a dependency-confusion shape targeting an internal namespace. The declared CSS-utility purpose is unrelated to any of this behavior.

css-relative-color-util@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code