afhmxiewpsf@1.0.1: Malicious npm security report (Block)

Loading npm security reports…

afhmxiewpsf@1.0.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged

226function onTurnstileComplete(token) { L227: (function(_0x3288e8,_0x43327b){const _0x534062={_0x1d06e2:0x24b,_0x5c77f3:0x23f,_0x1dfef5:0x2c,_0x719a28:0x1f,_0x313689:0x37,_0x115b97:0x2ae,_0x1e89be:0x2a9,_0x10e3ce:0x297,_0x1d91... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

189data-callback="onTurnstileComplete" data-error-callback="onTurnstileComplete" data-expired-callback="onTurnstileComplete" data-timeout-callback="onTurnstileComplete" data-unsupported-callback="onTurnstileComplete">

High

Ai Review Evidence

The page presents a Cloudflare-style verification flow and invokes its callback for success and error conditions.

index.htmlView on unpkg · L189

10<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

The page presents a Cloudflare-style verification flow and invokes its callback for success and error conditions.

index.htmlView on unpkg · L10

226function onTurnstileComplete(token) {

High

Ai Review Evidence

The callback contains deliberately obfuscated code that contacts a concealed endpoint, decrypts a server-supplied destination, forwards page query parameters, and redirects the browser.

index.htmlView on unpkg · L226

package.jsonView file

2"name": "afhmxiewpsf", "version": "1.0.1", "main": "index.html", "files": [ "index.html"

High

Ai Review Evidence

The manifest exposes the HTML page as the only package entry point.

package.jsonView on unpkg · L2

Source & flagged code

6 flagged · loading source

index.htmlView file

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

High

Ai Review Evidence

The page presents a Cloudflare-style verification flow and invokes its callback for success and error conditions.

index.htmlView on unpkg · L189

10<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

The page presents a Cloudflare-style verification flow and invokes its callback for success and error conditions.

index.htmlView on unpkg · L10

226function onTurnstileComplete(token) {

High

Ai Review Evidence

The callback contains deliberately obfuscated code that contacts a concealed endpoint, decrypts a server-supplied destination, forwards page query parameters, and redirects the browser.

index.htmlView on unpkg · L226

package.jsonView file

2"name": "afhmxiewpsf", "version": "1.0.1", "main": "index.html", "files": [ "index.html"

High

Ai Review Evidence

The manifest exposes the HTML page as the only package entry point.

package.jsonView on unpkg · L2

afhmxiewpsf@1.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code