registry / Credential exfiltration / airdzticket
airdzticket
This report shows the evidence for airdzticket@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect source inspection found a deceptive, obfuscated redirect that forwards browser query parameters to a concealed endpoint. The absence of npm lifecycle hooks does not mitigate this runtime browser attack behavior.
Static reason
No blocking static signals were detected.
Trigger
A user opens index.html and a Turnstile callback fires.
Impact
Query data can be exfiltrated to an undisclosed third party and users are redirected after a deceptive verification screen.
Mechanism
Obfuscated query-string forwarding and browser redirect.
Attack narrative
The sole packaged page presents itself as a Cloudflare verification screen. Its callbacks run obfuscated JavaScript that builds an undisclosed URL, appends every parameter from window.location.search, and replaces the current page with it. This creates a concrete phishing/exfiltration path for link-carried values.
AI rationale
Direct source inspection found a deceptive, obfuscated redirect that forwards browser query parameters to a concealed endpoint. The absence of npm lifecycle hooks does not mitigate this runtime browser attack behavior.
Evidence
package.jsonindex.html
Network endpoints1
challenges.cloudflare.com/turnstile/v0/api.js
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.html hides redirect logic behind heavy obfuscation.
- Turnstile callbacks invoke code that constructs a destination URL.
- It copies every current URL query parameter to that hidden destination.
- It navigates there with window.location.replace().
- The page impersonates a Cloudflare security verification screen.
Evidence against
- package.json has no lifecycle scripts.
- No Node entrypoint, filesystem access, or child-process behavior is present.
Behavioral surface
NoLicense
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
5 High1 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
LowNo License
Affected versions and remediation
This report applies to airdzticket@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing airdzticket@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.