add-colors-to-website
This report shows the evidence for add-colors-to-website@1.0.3. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms immediate, concealed navigation behavior with a dynamically selected external host and no color-related implementation. This is concrete malicious runtime behavior, not a static hint.
Static reason
No blocking static signals were detected.
Trigger
Runtime import/execution in a browser document with a parent window.
Impact
Phishing/open redirect, navigation hijacking, and potential client-side disruption.
Mechanism
Parent-DOM script injection and dynamic external redirect.
Attack narrative
When loaded, index.js creates a script in the parent document. That script extracts a host from the parent URL, redirects to its /join/org/ruVMZh4diDGLWa1t3c37hQ path after two seconds, and navigates another window to a very large query URL. This is unrelated to the package name and provides a concrete browser hijack chain.
AI rationale
Direct source inspection confirms immediate, concealed navigation behavior with a dynamically selected external host and no color-related implementation. This is concrete malicious runtime behavior, not a static hint.
Evidence
package.jsonindex.js
Network endpoints1
${parent.location.href.split('=')[1].split('&')[0]}/join/org/ruVMZh4diDGLWa1t3c37hQ
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js executes immediately on import.
- index.js injects a script into parent.document.
- Injected code redirects after 2 seconds to a host parsed from parent.location.href.
- It also navigates window[0] to a 16,381-character query URL.
Evidence against
- package.json has no lifecycle hooks.
- Package contains only package.json and index.js; no legitimate color functionality is present.
Behavioral surface
HighEntropyStrings
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
4 High2 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to add-colors-to-website@1.0.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing add-colors-to-website@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.