registry / popover-anchor-polyfill / 1.0.0

popover-anchor-polyfill@1.0.0

Polyfill for HTML popover anchor positioning

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The published registry source contains immediate system reconnaissance and external data transmission. The bundled registry manifest points loaders to that source.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Loading thunderboltRegistry.js in an environment supporting the required APIs.

Impact

Exposes system identity, network information, host mappings, and runtime details to an external recipient.

Mechanism

An immediately invoked function executes shell commands and sends collected output and hostname through HTTP requests.

Attack narrative

When the registry source is loaded, its initial function collects host details, executes reconnaissance commands, and forwards results to a fixed external endpoint. Registry factory exports follow this payload, and the bundled manifest directs multiple registry names to this file. The default npm entrypoint is inert, but direct registry loading activates concrete data exfiltration where the necessary APIs are available.

AI rationale

Inspected source proves immediate reconnaissance and external data exfiltration unrelated to popover positioning. The inert default entrypoint limits activation but does not neutralize the executable registry payload.

Evidence

package.jsonthunderboltRegistry.jsregistry-manifest.min.json/etc/hosts

Network endpoints1

dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3

The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that spawns shell commands via child_process.execSync (`id`, `whoami`, `uname -a`, `ifconfig`/`ip addr`) and reads `/etc/hosts`, then transmits each command's output together with hostname, Node version, platform, and pid over plain HTTP GET requests to the hardcoded endpoint http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3. The require path uses cache-bypass tricks (deleting require.cache entries matching 'thunderboltRegistry' and manually constructing a fresh Module to re-resolve child_process) to defeat mocking or interception. Sibling stub files and a `registry-manifest.min.json` impersonate Wix thunderbolt internal registry names (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, corvidRegistry) and reference static.parastorage.com, indicating a dependency-confusion lure targeting Wix build pipelines. The declared polyfill purpose does not match the shipped Wix-internal namespace exports, and no popover-polyfill functionality is implemented.

popover-anchor-polyfill@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code