registry / focus-visible-polyfill-lite / 1.0.0

focus-visible-polyfill-lite@1.0.0

Lightweight polyfill for :focus-visible pseudo-class

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The supplied registry module performs automatic host reconnaissance and data exfiltration when loaded. Its registry manifest exposes the payload under multiple registry names.

Static reason

No blocking static signals were detected.

Trigger

Loading thunderboltRegistry.js directly or through the supplied registry manifest.

Impact

Exposes user identity, operating-system details, network configuration and /etc/hosts contents when shell execution and fetch are available.

Mechanism

An immediately invoked function executes shell commands and sends their encoded output to a fixed HTTP endpoint using fetch.

Attack narrative

The package presents itself as a focus-visible polyfill but supplies a registry module that immediately collects host information and transmits it to an unrelated endpoint. The default import is empty, so activation requires loading the supplied registry module. The manifest provides references to that module under several registry names. This is executable exfiltration behavior, not an inert payload.

AI rationale

Inspected source proves automatic shell-based reconnaissance and transmission of host data to a fixed unrelated recipient. The empty default entrypoint and absence of install hooks limit activation but do not neutralize the malicious registry module.

Evidence

thunderboltRegistry.jsregistry-manifest.min.json/etc/hosts

Network endpoints1

dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3

OSV advisory

The package is advertised as a focus-visible polyfill but ships thunderboltRegistry.js, which impersonates Wix thunderbolt internal registry modules (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry, and others) via a Proxy-backed export stub. When the module is required, an IIFE at the top of the file uses child_process.execSync to run host reconnaissance commands (id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts) and sends the command output along with a beacon (Node version, platform, pid) via plain-HTTP GET requests to a hardcoded attacker-controlled endpoint at http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. The package self-labels the beacon as 'rce-poc'. The shape is a dependency-confusion / typosquat payload: a benign-sounding public package shadows Wix-internal registry names so that a build pipeline resolving these names from the public registry executes the reconnaissance payload with the installer's privileges on module load.

focus-visible-polyfill-lite@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code