css-snap-target-polyfill

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (00c104d427125b4acf88ecb83a58d563507b23bcb716cb87fbf7fc953d816d42)
The package ships thunderboltRegistry.js, which uses child_process and process.platform to collect host information and POSTs it via fetch() to the hardcoded external endpoint http://dxpoc.gt.tc. The destination is unrelated to any CSS polyfill functionality the package name advertises, is served over cleartext HTTP, and is not caller-configurable. This behavior does not correspond to the declared purpose of a CSS snap-target polyfill, which has no legitimate need to execute shell commands or beacon host details to a third-party domain.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.