registry / Credential exfiltration / abuden210
abuden210
Republished package
This report shows the evidence for abuden210@2.0.0, the only known version.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection confirms a concrete browser-time remote-code and traffic-proxy chain, despite no npm install hook. Obfuscation and bundled proxy infrastructure make the behavior materially unsafe for a republished npm package.
Static reason
One or more suspicious static signals were detected.
Trigger
User opens `index.html` in a browser.
Impact
Remote code executes in the page origin; the service worker can intercept routed requests and proxy browser traffic through the configured endpoint.
Mechanism
Startup-loaded third-party script plus service-worker-backed Scramjet proxy transport.
Attack narrative
This is not a normal reusable npm library: its declared entrypoint is a browser application. On page load it fetches executable JavaScript from `c.vipersfutbol.com`, then obfuscated application code invokes a boot module that registers a service worker. That worker and bundled Scramjet/libcurl runtime rewrite and proxy routed browser requests using `wss://21baseballacademy.com/fairs/`, including cookie synchronization mechanisms. This establishes unconsented third-party remote code execution and browser traffic interception when consumers open the package entrypoint.
AI rationale
Source inspection confirms a concrete browser-time remote-code and traffic-proxy chain, despite no npm install hook. Obfuscation and bundled proxy infrastructure make the behavior materially unsafe for a republished npm package.
Evidence
package.jsonindex.htmlassets/index-CJm_PfL2.jsassets/boot-CVPGRFHh.jsj6k3y8.jsct1tl/pap3do.jsassets/proxy-runtime-1NyFshf9.jsct1tl/csbzam.jsct1tl/jmqwjq.jsbfjdx/757lr8.jsbfjdx/w7m632.wasm
Network endpoints2
c.vipersfutbol.com/script.jswss://21baseballacademy.com/fairs/
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.html` loads third-party `c.vipersfutbol.com/script.js` at page startup.
- `assets/index-CJm_PfL2.js` dynamically imports and invokes `bootController` during app startup.
- `assets/boot-CVPGRFHh.js` registers `j6k3y8.js` as a service worker and configures a remote proxy WebSocket.
- `j6k3y8.js` intercepts routed fetch events; `ct1tl/*` implements Scramjet proxy/cookie rewriting.
- `assets/ChatPage-zoA8Z6RX.js` and `assets/index-CJm_PfL2.js` are deliberately obfuscated, obscuring startup behavior.
Evidence against
- `package.json` has no lifecycle scripts, bin, or Node entrypoint.
- No `child_process`, Node filesystem, environment harvesting, or install-time execution was found.
- The runtime behavior is browser-only and activates when the HTML app is opened.
- No AI-agent configuration/control-surface paths or mutation logic was found.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
Source & flagged code
7 flagged · loading sourceassets/proxy-runtime-1NyFshf9.jsView file
1patternName = aws_access_key
severity = critical
line = 1
matchedText = var OQ=O...B+=`
Critical
Critical Secret
Package contains a critical-looking secret pattern.
assets/proxy-runtime-1NyFshf9.jsView on unpkg · L11patternName = aws_access_key
severity = critical
line = 1
matchedText = var OQ=O...B+=`
Critical
Secret Pattern
AWS access key ID in assets/proxy-runtime-1NyFshf9.js
assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1bfjdx/757lr8.jsView file
17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(...
L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...
Medium
Findings
2 Critical3 High6 Medium4 Low
CriticalCritical Secretassets/proxy-runtime-1NyFshf9.js
CriticalSecret Patternassets/proxy-runtime-1NyFshf9.js
HighObfuscated Payload Loaderassets/ChatPage-zoA8Z6RX.js
HighObfuscated
HighShips High Entropy Blobassets/KaTeX_Script-Regular-D3wIWfF6.woff2
MediumDynamic Requirebfjdx/757lr8.js
MediumNetwork
MediumProtestware
MediumShips Wasm Modulebfjdx/w7m632.wasm
MediumStructural Risk Force Deep Review
MediumSecret Patternassets/livekit-C0E_jLSz.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to abuden210@2.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing abuden210@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.