registry / Remote code execution / abuden29
abuden29
Republished package
This report shows the evidence for abuden29@2.0.0. 3 of 4 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe remote executable dependency is a concrete attack mechanism, not merely a scanner signature; obfuscation and request-proxy machinery increase its risk. Lack of install hooks limits the trigger to browser runtime but does not make the packaged behavior safe.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user opens `index.html` or serves the package as its declared browser entrypoint.
Impact
The remote host can supply arbitrary JavaScript in the page's origin and access data available to that page.
Mechanism
Remote script execution plus service-worker-mediated browser request proxying.
Attack narrative
This package is an HTML application rather than a normal npm library. Its declared entry page automatically downloads and executes JavaScript from an unrelated remote host without a hash or other pinning, while local obfuscated code enables a service-worker-based proxy that intercepts selected browser requests and relays cookies. This creates a concrete remotely controlled browser execution surface whenever the packaged app is opened, although it is not activated merely by npm installation.
AI rationale
The remote executable dependency is a concrete attack mechanism, not merely a scanner signature; obfuscation and request-proxy machinery increase its risk. Lack of install hooks limits the trigger to browser runtime but does not make the packaged behavior safe.
Evidence
package.jsonindex.htmlj6k3y8.jsct1tl/jmqwjq.jsct1tl/pap3do.jsassets/index-CJm_PfL2.jsassets/proxy-runtime-1NyFshf9.jsbfjdx/757lr8.jsbfjdx/w7m632.wasm
Network endpoints2
c.vipersfutbol.com/script.jswww.googletagmanager.com/gtag/js?id=G-0VL3ZSBXDH
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.html` auto-loads `https://c.vipersfutbol.com/script.js` with no integrity pinning.
- `index.html` loads local proxy/service-worker components on page startup.
- `assets/index-CJm_PfL2.js` is heavily obfuscated and includes runtime fetch logic.
- `j6k3y8.js` installs a service worker that intercepts routed fetches.
- `ct1tl/jmqwjq.js` proxies intercepted requests and manages cookies between clients.
Evidence against
- `package.json` has no preinstall, install, postinstall, or other lifecycle script.
- The manifest entrypoint is `index.html`, so npm installation alone does not execute this browser payload.
- No Node child-process, local credential-file, or AI-agent configuration mutation was found.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestware
Source & flagged code
9 flagged · loading sourceassets/proxy-runtime-1NyFshf9.jsView file
1patternName = aws_access_key
severity = critical
line = 1
matchedText = var OQ=O...B+=`
Critical
Critical Secret
Package contains a critical-looking secret pattern.
assets/proxy-runtime-1NyFshf9.jsView on unpkg · L11patternName = aws_access_key
severity = critical
line = 1
matchedText = var OQ=O...B+=`
Critical
Secret Pattern
AWS access key ID in assets/proxy-runtime-1NyFshf9.js
assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1bfjdx/757lr8.jsView file
17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(...
L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...
Medium
Findings
2 Critical5 High6 Medium4 Low
CriticalCritical Secretassets/proxy-runtime-1NyFshf9.js
CriticalSecret Patternassets/proxy-runtime-1NyFshf9.js
HighObfuscated Payload Loaderassets/ChatPage-zoA8Z6RX.js
HighObfuscated
HighShips High Entropy Blobassets/KaTeX_Script-Regular-D3wIWfF6.woff2
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa.js
HighKnown Malware Source Fingerprint Signatureassets/ChatPage-zoA8Z6RX.js
MediumDynamic Requirebfjdx/757lr8.js
MediumNetwork
MediumProtestware
MediumShips Wasm Modulebfjdx/w7m632.wasm
MediumStructural Risk Force Deep Review
Medium
Affected versions and remediation
This report applies to abuden29@2.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing abuden29@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.