css-light-dark-polyfill

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (856c154d7855924568c88181f172f46e84aac202bd6cb29974eb2ffaa3ec3ea7)
The package presents itself as a trivial CSS polyfill (index.js exports an empty object) but ships thunderboltRegistry.js, which on load runs a self-invoking IIFE that collects host identifiers (os.hostname, node version, platform, pid) and the output of local shell commands (id, whoami, uname -a, ifconfig/ip addr, /etc/hosts via child_process.execSync) and POSTs each result via fetch() to the hardcoded endpoint https://dxpoc.gt.tc/callback.php/. The payload self-labels as 'beacon=rce-poc'. The package also exports factories under the names of internal Wix Thunderbolt build registries (thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, editorRegistry, etc.), and a bundled registry-manifest.min.json maps those names to parastorage.com URLs — a dependency-confusion shape targeting Wix-like build systems that resolve these internal registry module names. Installing or loading this package causes host reconnaissance data to be exfiltrated to an attacker-controlled domain unrelated to any CSS polyfill functionality.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.