css-snap-target-polyfill@1.0.0

Summary

The package ships thunderboltRegistry.js, which uses child_process and process.platform to collect host information and POSTs it via fetch() to the hardcoded external endpoint http://dxpoc.gt.tc. The destination is unrelated to any CSS polyfill functionality the package name advertises, is served over cleartext HTTP, and is not caller-configurable. This behavior does not correspond to the declared purpose of a CSS snap-target polyfill, which has no legitimate need to execute shell commands or beacon host details to a third-party domain.

Source: amazon-inspector (00c104d427125b4acf88ecb83a58d563507b23bcb716cb87fbf7fc953d816d42)