registry / css-scroll-state-polyfill / 1.0.0

css-scroll-state-polyfill@1.0.0

Polyfill for CSS scroll-state container queries

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The published registry asset contains immediately executing host reconnaissance and data exfiltration. Its bundled manifest directs registry loaders to that asset.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Loading thunderboltRegistry.js directly or through the registry manifest in an environment providing the required runtime APIs.

Impact

Exposure of host identity, operating system information, network configuration and /etc/hosts contents.

Mechanism

The payload runs shell commands, reads host configuration and sends results through fetch to a fixed webhook; it also removes matching module cache entries.

Attack narrative

Loading the registry asset immediately activates a reconnaissance payload. Where child_process and fetch are available, it executes host inspection commands and forwards their results, including host configuration, to a fixed external webhook. The manifest supplies a loading route despite the empty default entrypoint. No explicit user gate protects this collection or transmission.

AI rationale

Inspected source proves executable host-data exfiltration unrelated to a CSS polyfill. The empty default entrypoint limits activation but does not neutralize the published registry payload and its manifest loading route.

Evidence

package.jsonthunderboltRegistry.jsregistry-manifest.min.json/etc/hosts

Network endpoints2

webhook.site/0492a36c-4d7b-408a-865c-226db25987ba

The package presents itself as a CSS polyfill but ships a payload file (thunderboltRegistry.js) that executes an IIFE at require time. The IIFE uses child_process to run host-identification commands (id, whoami, uname -a, ifconfig/ip addr, /etc/hosts, hostname) and collects Node version, platform, and PID, then sends the captured data via fetch to a hardcoded webhook.site collector at https://webhook.site/0492a36c-4d7b-408a-865c-226db25987ba. The main index.js is an empty stub; filenames mimic internal Wix Thunderbolt registry modules, consistent with a dependency-confusion squat targeting that namespace. A self-identifying 'beacon=poc15' tag is included in the request. The payload also walks require.cache and deletes any entry whose key contains 'thunderboltRegistry', causing subsequent requires in the same process to re-execute the recon-and-exfiltration path rather than return a cached export, and exports a Proxy that answers arbitrary method accesses to blend in with the impersonated registry.

css-scroll-state-polyfill@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code