registry / afhmxiewpsf / 1.0.0

afhmxiewpsf@1.0.0

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Opening index.html presents a bot challenge. Its callback retrieves and decrypts a concealed redirect target, then navigates the browser while preserving URL parameters.

Static reason

One or more suspicious static signals were detected.

Trigger

A user opens index.html and the Turnstile callback runs.

Impact

The package can send a user to an attacker-controlled destination hidden from static inspection, including with forwarded query parameters.

Mechanism

Obfuscated remote payload retrieval, AES decryption, and browser redirection.

Attack narrative

The HTML imitates a Cloudflare verification page. Every Turnstile completion-related callback enters heavily obfuscated code that contacts an undisclosed endpoint, decrypts its response, appends the current page query parameters, and redirects the browser. The encrypted response keeps the final destination outside the published package, making this a concealed remote redirect loader.

Rationale

The package is a disguised browser redirect loader rather than a usable npm library. Its obfuscation, remotely supplied encrypted destination, and challenge-gated automatic navigation establish concrete malicious behavior.

Evidence

index.html

Network endpoints1

challenges.cloudflare.com

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

The package entry point is an HTML page that runs when opened.
Completing or failing the displayed Turnstile challenge invokes a large obfuscated callback.
That callback fetches an opaque remote response, decrypts it with Web Crypto, forwards the current query parameters, and navigates the browser to the decrypted URL.

Evidence against

package.json contains no npm lifecycle scripts.
The inspected source shows no local file access or child-process execution.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 37.1 KB of source

Source & flagged code

7 flagged

index.htmlView file

Lines 206-231html

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

216 (function () {

217 function generateRayId() {

218 const chars = '0123456789abcdef';

219 let result = '';

220 for (let i = 0; i < 16; i++) result += chars[Math.floor(Math.random() * 16)];

221 return result;

222 }

223 document.getElementById('dynamic-ray-id').textContent = generateRayId();

224 })();

225

226 function onTurnstileComplete(token) {

227 (function(_0x44bd1c,_0x35eac7){const _0x121e70={_0x2ac651:0x8d,_0x442892:0x52,_0x2171e6:0x7a,_0x36feae:0x44,_0x411fdc:0xb1,_0x5083f1:0x9c,_0x49628f:0x5e,_0x5649f4:0x2f,_0x201a33:0x72,_0x42fae6:0x76,_0x5a7dab:0x88,_0x35d309:0x1ac,_0xd60c0c:0x1a3,_0x389989:0x1b4,_0x110254:0x1bf,_0x37e5ad:0x176,_0x2099c5:0x177,_0xb92f3a:0x1c1,_0x2d1fea:0x199,_0x4017fa:0x69,_0x2ebe70:0x6f,_0x289661:0x45,_0x165188:0x2a,_0x5b1bdc:0x45,_0x11e2c7:0x41,_0x1d35ac:0xa0,_0x586ff1:0xbb,_0x59d776:0xda,_0x53080a:0xa6,_0x3903f8:0xbf,_0x5a29fa:0xe0,_0x144969:0xd,_0x353db4:0x48,_0x4fcfd6:0x20,_0x30ae5:0x1ea,_0x3a5b06:0x ...

High

Ai Review Evidence

Completing or failing the displayed Turnstile challenge invokes a large obfuscated callback.

index.htmlView on unpkg · L226

High

Ai Review Evidence

That callback fetches an opaque remote response, decrypts it with Web Crypto, forwards the current query parameters, and navigates the browser to the decrypted URL.

index.htmlView on unpkg · L227

High

Ai Review Evidence

That callback fetches an opaque remote response, decrypts it with Web Crypto, forwards the current query parameters, and navigates the browser to the decrypted URL.

index.htmlView on unpkg · L227

High

Ai Review Evidence

That callback fetches an opaque remote response, decrypts it with Web Crypto, forwards the current query parameters, and navigates the browser to the decrypted URL.

index.htmlView on unpkg · L227

228 }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

229</script>

230</body>

231</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

package.jsonView file

Lines 1-9json

2 "name": "afhmxiewpsf",

3 "version": "1.0.0",

4 "main": "index.html",

5 "files": [

6 "index.html"

Source & flagged code

7 flagged · loading source

index.htmlView file

226function onTurnstileComplete(token) { L227: (function(_0x44bd1c,_0x35eac7){const _0x121e70={_0x2ac651:0x8d,_0x442892:0x52,_0x2171e6:0x7a,_0x36feae:0x44,_0x411fdc:0xb1,_0x5083f1:0x9c,_0x49628f:0x5e,_0x5649f4:0x2f,_0x201a33:0x... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

226function onTurnstileComplete(token) { (function(_0x44bd1c,_0x35eac7){const _0x121e70=

High

Ai Review Evidence

Completing or failing the displayed Turnstile challenge invokes a large obfuscated callback.

index.htmlView on unpkg · L226

227

Findings

7 High1 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidencepackage.json

HighAi Review Evidenceindex.html

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License