registry / @worrisome/reutil / 1.0.2

@worrisome/reutil@1.0.2

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Opening the package's HTML entrypoint displays a fake security challenge. Completing it activates obfuscated code that obtains and decrypts a remote redirect target, then forwards browser query parameters.

Static reason

One or more suspicious static signals were detected.

Trigger

A user opens index.html and completes or errors the Turnstile challenge.

Impact

Can route victims, with URL parameters, to attacker-controlled content.

Mechanism

Obfuscated server-controlled decrypted redirect behind a fake verification page.

Attack narrative

The sole package entrypoint is a Cloudflare-styled verification page. Its Turnstile callback runs heavily obfuscated code that POSTs to a concealed service, decrypts the response into a URL, appends the current page's query parameters, and redirects the browser. This is a concrete staged phishing/redirect chain rather than reusable package functionality.

Rationale

This package contains no legitimate library implementation; its sole runtime artifact is an obfuscated, server-controlled redirect flow concealed behind a verification prompt.

Evidence

index.htmlpackage.json

Network endpoints1

challenges.cloudflare.com/turnstile/v0/api.js

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

Manifest exposes only an HTML page as the package entrypoint.
The page impersonates a security-verification screen and invokes obfuscated logic after Turnstile completion.
The callback POSTs to a concealed endpoint, decrypts a server-provided URL, copies current query parameters, and redirects the browser.

Evidence against

No npm lifecycle scripts are declared.
No local filesystem, environment, or child-process access is present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 33.3 KB of source

Source & flagged code

5 flagged

index.htmlView file

Lines 206-231html

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

216 (function () {

217 function generateRayId() {

218 const chars = '0123456789abcdef';

219 let result = '';

220 for (let i = 0; i < 16; i++) result += chars[Math.floor(Math.random() * 16)];

221 return result;

222 }

223 document.getElementById('dynamic-ray-id').textContent = generateRayId();

224 })();

225

226 function onTurnstileComplete(token) {

227 (function(_0x4b1974,_0x5076f1){const _0x1a7af0={_0x162f87:0x51f,_0x53ffc8:0x4fe,_0x37e9e2:0x53e,_0x3319a8:0x501,_0x44eb39:0x50d,_0x4b9700:0x4cc,_0x25864b:0x50e,_0x404fcc:0x522,_0x2769bd:0x507,_0xacb79b:0x549,_0xa5830c:0x519,_0x12dcdf:0x1b3,_0x28da48:0x1a5,_0x59c7e3:0x1c8,_0x418cdc:0x4f6,_0x2623a4:0x4e1,_0x3c40fb:0x50e,_0x26d6b7:0x50c,_0xa773de:0x14e,_0x35f017:0x193,_0x280e5d:0x187,_0x83f710:0x550,_0x43bd5c:0x57c,_0x470df3:0x54f,_0x16beb7:0x181,_0x30c9bd:0x17a,_0x34abc6:0x15e,_0x522ca4:0x12c,_0x10d555:0x149,_0x5dc1b6:0x4fb,_0x10b333:0x4f9,_0x3496fc:0x514,_0x363e15:0x51c,_0x12ecf7:0x510, ...

High

Ai Review Evidence

The callback POSTs to a concealed endpoint, decrypts a server-provided URL, copies current query parameters, and redirects the browser.

index.htmlView on unpkg · L227

High

Ai Review Evidence

The callback POSTs to a concealed endpoint, decrypts a server-provided URL, copies current query parameters, and redirects the browser.

index.htmlView on unpkg · L227

228 }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

229</script>

230</body>

231</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

package.jsonView file

Lines 1-9json

2 "name": "@worrisome/reutil",

3 "version": "1.0.2",

4 "main": "index.html",

5 "files": [

6 "index.html"

Source & flagged code

5 flagged · loading source

index.htmlView file

226function onTurnstileComplete(token) { L227: (function(_0x4b1974,_0x5076f1){const _0x1a7af0={_0x162f87:0x51f,_0x53ffc8:0x4fe,_0x37e9e2:0x53e,_0x3319a8:0x501,_0x44eb39:0x50d,_0x4b9700:0x4cc,_0x25864b:0x50e,_0x404fcc:0x522,_0x2... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

227'mxTCs':'POST','xWgkL':'applicatio'+'n/json'

High

Ai Review Evidence

The callback POSTs to a concealed endpoint, decrypts a server-provided URL, copies current query parameters, and redirects the browser.

index.htmlView on unpkg · L227

227

Findings

5 High1 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidencepackage.json

HighAi Review Evidenceindex.html

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License