registry / abuden24 / 2.0.0

abuden24@2.0.0

Republished package

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Opening the package's browser entry immediately imports an unrelated remote script and initializes a service-worker browser proxy. The proxy forwards routed requests, including request metadata and bodies, to a remote WebSocket transport.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A user opens `index.html` or serves the package as a web application.

Impact

An external operator can execute browser code and observe or relay proxied application traffic, including submitted credentials handled by the obfuscated UI.

Mechanism

Remote script execution plus service-worker interception and remote proxy transport.

Attack narrative

The package is a disguised, obfuscated web application rather than a normal npm library. When opened, it executes a remote third-party script, registers a service worker, and routes matching browser requests through a WebSocket proxy. Its obfuscated chat/account code processes username, password, and captcha values, creating a concrete credential-interception and remote-code-execution surface.

Rationale

Source inspection confirms executable remote code loading and a persistent browser request-interception proxy tied to unrelated hosts. This is concrete harmful behavior despite the absence of npm lifecycle hooks.

Evidence

package.jsonindex.htmlassets/boot-CVPGRFHh.jsj6k3y8.jsct1tl/jmqwjq.jsassets/ChatPage-zoA8Z6RX.js

Network endpoints2

c.vipersfutbol.com/script.jswss://21baseballacademy.com/fairs/

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

`index.html` loads and executes `https://c.vipersfutbol.com/script.js`.
`assets/boot-CVPGRFHh.js` registers `j6k3y8.js` as a service worker.
`assets/boot-CVPGRFHh.js` routes traffic through `wss://21baseballacademy.com/fairs/`.
`ct1tl/jmqwjq.js` intercepts matching fetches and forwards URL, headers, and body.
`assets/ChatPage-zoA8Z6RX.js` is heavily obfuscated and handles username/password/captcha requests.
The manifest disguises this browser application as `abuden24` with only `index.html` as main.

Evidence against

`package.json` has no lifecycle scripts.
No Node filesystem, process, or child-process execution was found.
The observed behavior activates when the packaged page is opened, not during npm install.

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 24 file(s), 7.27 MB of source, external domains: 127.0.0.1, aomediacodec.github.io, cdn.jsdelivr.net, cloud-api.livekit.io, curl.se, emscripten.org, fingerprint.com, github.com, m1.openfpcdn.io, react.dev, sj-cache.invalid, twemoji.maxcdn.com, www.w3.org, www.zlib.net

Source & flagged code

9 flagged

assets/proxy-runtime-1NyFshf9.jsView file

1patternName = aws_access_key severity = critical line = 1 matchedText = var OQ=O...B+=`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1

1patternName = aws_access_key severity = critical line = 1 matchedText = var OQ=O...B+=`

Critical

Secret Pattern

AWS access key ID in assets/proxy-runtime-1NyFshf9.js

assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1

bfjdx/757lr8.jsView file

Lines 1-31javascript

1(()=>{let e,t;var r,i,n,s,o,a,A={8770(e,t,r){var i={"./":"6418","./client":"6039","./client.ts":"6039","./dom/attr":"8806","./dom/attr.ts":"8806","./dom/beacon":"7265","./dom/beacon.ts":"7265","./dom/cookie":"8227","./dom/cookie.ts":"8227","./dom/css":"8114","./dom/css.ts":"8114","./dom/document":"6820","./dom/document.ts":"6820","./dom/element":"1733","./dom/element.ts":"1733","./dom/fontface":"737","./dom/fontface.ts":"737","./dom/fragments":"2452","./dom/fragments.ts":"2452","./dom/history":"4397","./dom/history.ts":"4397","./dom/open":"5421","./dom/open.ts":"5421","./dom/origin":"8703","./ ...

3// SCRAMJET FUNCTION INTERCEPT

4// target: ${e}

5// frame: ${r}

6// location: ${s}

8function apply(fn, that, args) {

9 return Reflect.apply(fn, that, args);

10}

12function construct(fn, args, newTarget) {

13 return Reflect.construct(fn, args, newTarget);

14}

16return { apply, construct };

18//# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(a.fn,a.args,a.newTarget))};return(r.construct(a),s)?n:o(a.fn,a.args,a.newTarget)}),r.apply&&(l.apply=(e,t,i)=>{let s,o=!1,a={fn:e,this:t,args:i,newTarget:null,return:e=>{o=!0,s=e},call:()=>(o=!0,s=n(a.fn,a.this,a.args))};if(!this.flagEnabled("debugTrampolines")&&this.flagEnabled("allowFailedIntercepts"))return(r.apply(a),o)?s:n(a.fn,a.this,a.args);let A=g.$D.prepareStackTrace,l=this;g.$D.prepareStackTrace=function(e, ...

19//# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arrayBuffer()),o.url,e.context,r.meta,r.isModule);default:return o.body}}},6967(e,t,r){r.d(t,{A4:()=>u});var i=r(3235),n=r(5657),s=r(7492),o=r(4e3),a=r(2967),A=r(7959),l=r(3129),c=r(49),h=r(5994);async function u(e,t){var r;let i,u=(0,s.T)(t,e);if("blob:"===(r=u.url).protocol||"data:"===r.protocol)return d(e,t,u);let m={};if(await l.C.dispatch(e.hooks.fetch.intercept,{request:t,parsed:u},m),m.response)return m.response;i ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bfjdx/757lr8.jsView on unpkg · L17

20 background-color: ${{log:"#000",warn:"#f80",error:"#f00",debug:"transparent"}[e]};

21 color: ${{log:"#fff",warn:"#fff",error:"#fff",debug:"gray"}[e]};

22 padding: ${{log:2,warn:4,error:4,debug:0}[e]}px;

23 font-weight: bold;

24 font-family: monospace;

25 font-size: 0.9em;

26 `,`${"debug"===e?"color: gray":""}`,...i)},log:function(e,...t){this.fmt("log",e,...t)},warn:function(e,...t){this.fmt("warn",e,...t)},error:function(e,...t){this.fmt("error",e,...t)},debug:function(e,...t){this.fmt("debug",e,...t)},time(e,t,r){let n,s=(0,i.wU)()-t;n=s<1?"BLAZINGLY FAST":s<500?"decent speed":"really slow",this.print("debug","[time]",`${r} was ${n} (${s.toFixed(2)}ms)`)}}},6372(e,t,r){r.d(t,{c:()=>s});var i=r(5994),n=r(2075);class s{cookies={};byDomain=new Map;defaultPath(e){let t=e.pathname;if(!t||!t.startsWith("/"))return"/";let r=t.lastIndexOf("/");return r<=0?"/":t.slice( ...

27${e}`):`${e}

28${c}`}}if((0,i.U5)("rewriterLogs",r,n.base))for(let e of A.errors)o.error("oxc parse error",e);return c}catch(a){if(o.warn("failed rewriting js for",t||"(unknown)",a.message,"string"!=typeof e?(0,s.hS)(e):e),(0,i.U5)("allowInvalidJs",r,n.base))return e;throw a}}Error.stackTraceLimit=50},

29`:`importScripts("${e}");

30`,c=r.interface.getWorkerInjectScripts(a,A,l),h=(0,n.o)(e,t,r,a,A);if("string"!=typeof h&&(h=(0,s.hS)(h)),(0,i.U5)("encapsulateWorkers",r,a.origin)){let e;h+=`//# sourceURL=${t}`,c+=l((e=h,`data:text/javascript;charset=utf-8;base64,${(0,o.K)(e)}`))}else c+=h;return c}},2075(e,t,r){r.d(t,{Ay:()=>o});let i=new TextEncoder;function n(e){return"string"==typeof e&&!!e.trim()}function s(e){for(let t=0;t<e.length;t++){let r=e.charCodeAt(t);if((r>=0&&r<=31||127===r)&&9!==r)return!0}return!1}let o=function(e){return n(e)?[e].map(e=>(function(e){var t,r,o;let a,A,l,c=e.split(";"),h=c.shift();if(!h||!h.t ...

31//# sourceMappingURL=scramjet.js.map

Long lines were clipped for display.

assets/ChatPage-zoA8Z6RX.jsView file

1(function(_0x31bba3,_0x379132){const _0x159e7b={_0x26fc34:0x358,_0x56fc24:0x70c,_0x216b69:0x578,_0x22d6fc:0x60b,_0x33af41:0x2a6,_0x514b56:0x7f9,_0x4ccc4c:0x9d1,_0x35dd24:0xfdf,_0x1...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

assets/ChatPage-zoA8Z6RX.jsView on unpkg · L1

•matchType = malicious_source_fingerprint_signature signature = 2d82bc066e3c546d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = abuden21@2.0.0 matchedPath = assets/ChatPage-zoA8Z6RX.js matchedIdentity = npm:YWJ1ZGVuMjE:2.0.0 similarity = 1.000 shingleOverlap = 14 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

assets/ChatPage-zoA8Z6RX.jsView on unpkg

bfjdx/w7m632.wasmView file

•path = bfjdx/w7m632.wasm kind = wasm_module sizeBytes = 586279 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bfjdx/w7m632.wasmView on unpkg

assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

assets/fingerprint-Y5nV5FVa.jsView file

•matchType = normalized_sha256 matchedPackage = abuden21@2.0.0 matchedPath = assets/fingerprint-Y5nV5FVa.js matchedIdentity = npm:YWJ1ZGVuMjE:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/fingerprint-Y5nV5FVa.jsView on unpkg

assets/livekit-C0E_jLSz.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Hardcoded password in assets/livekit-C0E_jLSz.js

assets/livekit-C0E_jLSz.jsView on unpkg · L13

Source & flagged code

9 flagged · loading source

assets/proxy-runtime-1NyFshf9.jsView file

1patternName = aws_access_key severity = critical line = 1 matchedText = var OQ=O...B+=`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1

1patternName = aws_access_key severity = critical line = 1 matchedText = var OQ=O...B+=`

Critical

Secret Pattern

AWS access key ID in assets/proxy-runtime-1NyFshf9.js

assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1

bfjdx/757lr8.jsView file

17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(... L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bfjdx/757lr8.jsView on unpkg · L17

assets/ChatPage-zoA8Z6RX.jsView file

1(function(_0x31bba3,_0x379132){const _0x159e7b={_0x26fc34:0x358,_0x56fc24:0x70c,_0x216b69:0x578,_0x22d6fc:0x60b,_0x33af41:0x2a6,_0x514b56:0x7f9,_0x4ccc4c:0x9d1,_0x35dd24:0xfdf,_0x1...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

assets/ChatPage-zoA8Z6RX.jsView on unpkg · L1

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

assets/ChatPage-zoA8Z6RX.jsView on unpkg

bfjdx/w7m632.wasmView file

•path = bfjdx/w7m632.wasm kind = wasm_module sizeBytes = 586279 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bfjdx/w7m632.wasmView on unpkg

assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

assets/fingerprint-Y5nV5FVa.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/fingerprint-Y5nV5FVa.jsView on unpkg

assets/livekit-C0E_jLSz.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Hardcoded password in assets/livekit-C0E_jLSz.js

assets/livekit-C0E_jLSz.jsView on unpkg · L13

Findings

2 Critical5 High6 Medium4 Low

CriticalCritical Secretassets/proxy-runtime-1NyFshf9.js

CriticalSecret Patternassets/proxy-runtime-1NyFshf9.js

HighObfuscated Payload Loaderassets/ChatPage-zoA8Z6RX.js

HighObfuscated

HighShips High Entropy Blobassets/KaTeX_Script-Regular-D3wIWfF6.woff2

HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa.js

HighKnown Malware Source Fingerprint Signatureassets/ChatPage-zoA8Z6RX.js

MediumDynamic Requirebfjdx/757lr8.js

MediumNetwork

MediumProtestware

MediumShips Wasm Modulebfjdx/w7m632.wasm

MediumStructural Risk Force Deep Review

MediumSecret Patternassets/livekit-C0E_jLSz.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

9 flagged

assets/proxy-runtime-1NyFshf9.jsView file

1patternName = aws_access_key severity = critical line = 1 matchedText = var OQ=O...B+=`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1

1patternName = aws_access_key severity = critical line = 1 matchedText = var OQ=O...B+=`

Critical

Secret Pattern

AWS access key ID in assets/proxy-runtime-1NyFshf9.js

assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1

bfjdx/757lr8.jsView file

Lines 1-31javascript

3// SCRAMJET FUNCTION INTERCEPT

4// target: ${e}

5// frame: ${r}

6// location: ${s}

8function apply(fn, that, args) {

9 return Reflect.apply(fn, that, args);

10}

12function construct(fn, args, newTarget) {

13 return Reflect.construct(fn, args, newTarget);

14}

16return { apply, construct };

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bfjdx/757lr8.jsView on unpkg · L17

20 background-color: ${{log:"#000",warn:"#f80",error:"#f00",debug:"transparent"}[e]};

21 color: ${{log:"#fff",warn:"#fff",error:"#fff",debug:"gray"}[e]};

22 padding: ${{log:2,warn:4,error:4,debug:0}[e]}px;

23 font-weight: bold;

24 font-family: monospace;

25 font-size: 0.9em;

27${e}`):`${e}

29`:`importScripts("${e}");

31//# sourceMappingURL=scramjet.js.map

Long lines were clipped for display.

assets/ChatPage-zoA8Z6RX.jsView file

1(function(_0x31bba3,_0x379132){const _0x159e7b={_0x26fc34:0x358,_0x56fc24:0x70c,_0x216b69:0x578,_0x22d6fc:0x60b,_0x33af41:0x2a6,_0x514b56:0x7f9,_0x4ccc4c:0x9d1,_0x35dd24:0xfdf,_0x1...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

assets/ChatPage-zoA8Z6RX.jsView on unpkg · L1

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

assets/ChatPage-zoA8Z6RX.jsView on unpkg

bfjdx/w7m632.wasmView file

•path = bfjdx/w7m632.wasm kind = wasm_module sizeBytes = 586279 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bfjdx/w7m632.wasmView on unpkg

assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

assets/fingerprint-Y5nV5FVa.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/fingerprint-Y5nV5FVa.jsView on unpkg

assets/livekit-C0E_jLSz.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Hardcoded password in assets/livekit-C0E_jLSz.js

assets/livekit-C0E_jLSz.jsView on unpkg · L13