registry / Remote code execution / abuden229
abuden229
Republished package
This report shows the evidence for abuden229@2.0.0. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is not merely obfuscated vendor code: the entry page directly delegates execution to an unrelated remote host and activates a cookie-aware proxy control plane. The absence of install hooks limits the trigger to browser runtime but does not remove the concrete attack surface.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user opens `index.html` in a browser.
Impact
The remote script can execute arbitrary code in the page; the bundled proxy can route browser requests and cookies through its configured transport.
Mechanism
Remote JavaScript bootstrap plus service-worker traffic and cookie interception.
Attack narrative
The package presents an HTML file as its npm main entry, which loads an arbitrary external script immediately. Its local bundles register a service worker and configure a Scramjet-style proxy that intercepts routed requests, persists cookies, and communicates over a WebSocket endpoint. This creates a concrete remote-code and browser-traffic-control chain when the HTML is opened, even though npm installation itself has no lifecycle hook.
AI rationale
This is not merely obfuscated vendor code: the entry page directly delegates execution to an unrelated remote host and activates a cookie-aware proxy control plane. The absence of install hooks limits the trigger to browser runtime but does not remove the concrete attack surface.
Evidence
package.jsonindex.htmlassets/boot-CVPGRFHh.jsj6k3y8.jsct1tl/csbzam.jsct1tl/pap3do.jsbfjdx/757lr8.jsbfjdx/w7m632.wasm
Network endpoints2
c.vipersfutbol.com/script.jswss://21baseballacademy.com/fairs/
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.html` loads executable remote script from `https://c.vipersfutbol.com/script.js`.
- `assets/boot-CVPGRFHh.js` registers `j6k3y8.js` as a service worker.
- `j6k3y8.js` routes matching fetches through bundled proxy code.
- `assets/boot-CVPGRFHh.js` configures a proxy WebSocket at `wss://21baseballacademy.com/fairs/`.
- `ct1tl/csbzam.js` and `ct1tl/pap3do.js` synchronize and persist proxied cookies.
- `package.json` has no lifecycle scripts, so this is browser-runtime rather than install-time execution.
Evidence against
- No `preinstall`, `install`, or `postinstall` hook in `package.json`.
- No Node child-process, local filesystem, or environment-variable harvesting was found in inspected entry files.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestware
Source & flagged code
9 flagged · loading sourceassets/proxy-runtime-1NyFshf9.jsView file
1patternName = aws_access_key
severity = critical
line = 1
matchedText = var OQ=O...B+=`
Critical
Critical Secret
Package contains a critical-looking secret pattern.
assets/proxy-runtime-1NyFshf9.jsView on unpkg · L11patternName = aws_access_key
severity = critical
line = 1
matchedText = var OQ=O...B+=`
Critical
Secret Pattern
AWS access key ID in assets/proxy-runtime-1NyFshf9.js
assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1bfjdx/757lr8.jsView file
17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(...
L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...
Medium
Findings
2 Critical5 High6 Medium4 Low
CriticalCritical Secretassets/proxy-runtime-1NyFshf9.js
CriticalSecret Patternassets/proxy-runtime-1NyFshf9.js
HighObfuscated Payload Loaderassets/ChatPage-zoA8Z6RX.js
HighObfuscated
HighShips High Entropy Blobassets/KaTeX_Script-Regular-D3wIWfF6.woff2
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa.js
HighKnown Malware Source Fingerprint Signatureassets/ChatPage-zoA8Z6RX.js
MediumDynamic Requirebfjdx/757lr8.js
MediumNetwork
MediumProtestware
MediumShips Wasm Modulebfjdx/w7m632.wasm
MediumStructural Risk Force Deep Review
Medium
Affected versions and remediation
This report applies to abuden229@2.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing abuden229@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.