registry / css-scroll-anchor-polyfill / 1.0.0

css-scroll-anchor-polyfill@1.0.0

Polyfill for CSS scroll anchoring in older browsers

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The shipped registry module automatically collects host information and transmits it to an external callback. Its bundled manifest exposes that module as several registry assets.

Static reason

No blocking static signals were detected.

Trigger

Loading or evaluating thunderboltRegistry.js, directly or through a manifest-based registry loader.

Impact

Exposure of host configuration, account identity, working directory, network information and runtime metadata when the necessary APIs are available.

Mechanism

An immediately invoked function loads child_process, runs reconnaissance commands and sends encoded results through fetch; it also sends process metadata.

Attack narrative

Loading the registry asset immediately activates host reconnaissance and outbound reporting. In Node environments with child_process and fetch available, shell command results are transmitted to a hardcoded external recipient. The behavior requires no caller authorization and is unrelated to CSS scroll anchoring. The empty default entrypoint limits activation but does not neutralize the shipped executable attack.

AI rationale

Inspected source proves automatic host-data collection and transmission in a distributed registry module. This is concrete data exfiltration, despite the absence of install hooks and the empty default entrypoint.

Evidence

thunderboltRegistry.jsregistry-manifest.min.json/etc/hosts

Network endpoints1

dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3

OSV advisory

Package is published as css-scroll-anchor-polyfill but its index.js is empty and its contents impersonate internal Wix thunderbolt registry module names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, and others) with a shipped registry-manifest.min.json mapping them to parastorage.com URLs. The declared purpose (a CSS scroll-anchor polyfill) is unrelated to the shipped code. thunderboltRegistry.js contains a top-level IIFE that executes on require: it runs local reconnaissance via child_process.execSync (cat /etc/hosts, whoami, id, pwd, ifconfig/ip addr, hostname, uname -a) and transmits the collected output together with a beacon (node version, process.platform, pid) via fetch to a hardcoded HTTP endpoint at http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. Any internal build that resolves one of the impersonated thunderbolt names to this public package and requires the corresponding submodule triggers the reconnaissance and exfiltration path.

css-scroll-anchor-polyfill@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code