registry / @cyberdefenseinc/muypil / 1.0.5

@cyberdefenseinc/muypil@1.0.5

Muypil™ - Tracker Javascript Library ========================

AI Security Review

scanned 27d ago · by lpm-firewall-ai

This is a user-included browser tracker aimed at the package's own host, gated on a page query parameter, with fetch credentials set to omit and no lifecycle scripts. Obfuscation hides that beacon but does not add install-time mutation, cookie theft, or a second recipient.

Static reason

One or more suspicious static signals were detected.

Trigger

A site includes tracker.js and the page URL has an __mp_ulid query parameter.

Impact

The vendor receives analytics about that page view. Nothing runs at npm install, and stored secrets are not read or sent.

Mechanism

The script collects screen, navigator, WebGL, audio, battery, and pointer fields and POSTs them as JSON to the Muypil tracker path.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 84.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json 1.0.5 has no preinstall, install, or postinstall script; the only script is a test echo, and main names tracker.min.js.
tracker.js runs only when the page URL contains the __mp_ulid query value, then POSTs JSON to https://api-v1.muypil.com/tracker/page-events with credentials omit.
The body is a browser fingerprint plus pointer metrics; localStorage and sessionStorage are probed with a temporary value and then cleared.

Evidence against

The host, path, and credential mode are assembled from a rotated string table, so the beacon is not plain to read.
The declared main file tracker.min.js is not in the package, so a normal Node require does not load this script.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

MinifiedObfuscatedTrivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 14.4 KB of source

Source & flagged code

9 flagged

tracker.jsView file

1function _0x2c30(){const _0x5e67d2=['level','ipboard_re','screen_hei','getContext','unknown','availWidth','zIvgh','indexedDB','6lAOZvN','bPOdN','createElem','points','ZxjcO','scree...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

tracker.jsView on unpkg · L1

1fetch,''+_0x5b656f+this[_0x34cd37(0xb9)],{'method':_0x2c88b5[_0x34cd37(0x191)],'body':JSON[_0x34cd37(0x16d)](this[_0x34cd37(0x178)]),'keepalive':!![],'credentials':_0x2c88b5[_0x34c

Low

Ai Review Evidence

tracker.js runs only when the page URL contains the __mp_ulid query value, then POSTs JSON to https://api-v1.muypil.com/tracker/page-events with credentials omit.

tracker.jsView on unpkg · L1

1_0x57159f=new URL(window[_0x284267(0xdd)][_0x284267(0x168)])[_0x284267(0xc2)+'ms'][_0x284267(0xf9)](_0x284267(0x17b));function _0x2282(_0x28

Low

Ai Review Evidence

tracker.js runs only when the page URL contains the __mp_ulid query value, then POSTs JSON to https://api-v1.muypil.com/tracker/page-events with credentials omit.

tracker.jsView on unpkg · L1

1if(_0x57159f)_0x33f255(_0x57159f);

Low

Ai Review Evidence

tracker.js runs only when the page URL contains the __mp_ulid query value, then POSTs JSON to https://api-v1.muypil.com/tracker/page-events with credentials omit.

tracker.jsView on unpkg · L1

1'https://ap','669953kEJGOo','vel','offse

Low

Ai Review Evidence

tracker.js runs only when the page URL contains the __mp_ulid query value, then POSTs JSON to https://api-v1.muypil.com/tracker/page-events with credentials omit.

tracker.jsView on unpkg · L1

1'/tracker/p','battery_le','10STdtKe','dKXSN','ncurrency','audio_stat','geolocatio','bilities','feature_no','DateTimeFo','SsOdA','jOLPr','tiltX','rfuZE','getSupp

Low

Ai Review Evidence

tracker.js runs only when the page URL contains the __mp_ulid query value, then POSTs JSON to https://api-v1.muypil.com/tracker/page-events with credentials omit.

tracker.jsView on unpkg · L1

1'__mp_ulid','omit','feature_we','Piypl','audio_outp','hardwareCo','brtc','unavai

Low

Ai Review Evidence

tracker.js runs only when the page URL contains the __mp_ulid query value, then POSTs JSON to https://api-v1.muypil.com/tracker/page-events with credentials omit.

tracker.jsView on unpkg · L1

1localStorage[_0x526073(0xbf)](_0xbfbc4d[_0x526073(0xfc)],'1'),localStorage[_0x526073(0x19a)](_0xbfbc4d[_0x526073(0xfc)]),!![];}catch(_0x3226e0){return![];}})())

Low

Ai Review Evidence

The body is a browser fingerprint plus pointer metrics; localStorage and sessionStorage are probed with a temporary value and then cleared.

tracker.jsView on unpkg · L1

package.jsonView file

1{ "name": "@cyberdefenseinc/muypil", "version": "1.0.5", "main": "tracker.min.js", "scripts": { "test": "echo \"Error: no test specified\" && exit 1" }, "key

Low

Suspicious Lifecycle Evidence

package.json 1.0.5 has no preinstall, install, or postinstall script; the only script is a test echo, and main names tracker.min.js.

package.jsonView on unpkg · L1

Source & flagged code

9 flagged · loading source

tracker.jsView file

1function _0x2c30(){const _0x5e67d2=['level','ipboard_re','screen_hei','getContext','unknown','availWidth','zIvgh','indexedDB','6lAOZvN','bPOdN','createElem','points','ZxjcO','scree...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

tracker.jsView on unpkg · L1

1fetch,''+_0x5b656f+this[_0x34cd37(0xb9)],{'method':_0x2c88b5[_0x34cd37(0x191)],'body':JSON[_0x34cd37(0x16d)](this[_0x34cd37(0x178)]),'keepalive':!![],'credentials':_0x2c88b5[_0x34c

Low

Ai Review Evidence

tracker.js runs only when the page URL contains the __mp_ulid query value, then POSTs JSON to https://api-v1.muypil.com/tracker/page-events with credentials omit.

tracker.jsView on unpkg · L1

1_0x57159f=new URL(window[_0x284267(0xdd)][_0x284267(0x168)])[_0x284267(0xc2)+'ms'][_0x284267(0xf9)](_0x284267(0x17b));function _0x2282(_0x28

Low

Ai Review Evidence

tracker.js runs only when the page URL contains the __mp_ulid query value, then POSTs JSON to https://api-v1.muypil.com/tracker/page-events with credentials omit.

tracker.jsView on unpkg · L1

Findings

2 High1 Medium9 Low

HighObfuscated Payload Loadertracker.js

HighObfuscated

MediumStructural Risk Force Deep Review

LowScripts Present

LowSuspicious Lifecycle Evidencepackage.json

LowAi Review Evidencetracker.js

Affected versions and remediation

This report applies to @cyberdefenseinc/muypil@1.0.5.

See all versions of @cyberdefenseinc/muypil for other recorded verdicts.

Review the evidence and your use of @cyberdefenseinc/muypil@1.0.5 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-26 07:13:49.439Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.