registry / airdzticket / 1.0.0

airdzticket@1.0.0

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Opening the packaged HTML loads a Cloudflare Turnstile challenge. On completion, error, expiry, timeout, or unsupported callback, obfuscated code forwards URL query parameters to a hidden destination and redirects the browser.

Static reason

No blocking static signals were detected.

Trigger

A user opens index.html and a Turnstile callback fires.

Impact

Query data can be exfiltrated to an undisclosed third party and users are redirected after a deceptive verification screen.

Mechanism

Obfuscated query-string forwarding and browser redirect.

Attack narrative

The sole packaged page presents itself as a Cloudflare verification screen. Its callbacks run obfuscated JavaScript that builds an undisclosed URL, appends every parameter from window.location.search, and replaces the current page with it. This creates a concrete phishing/exfiltration path for link-carried values.

Rationale

Direct source inspection found a deceptive, obfuscated redirect that forwards browser query parameters to a concealed endpoint. The absence of npm lifecycle hooks does not mitigate this runtime browser attack behavior.

Evidence

package.jsonindex.html

Network endpoints1

challenges.cloudflare.com/turnstile/v0/api.js

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13782

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in airdzticket (npm)

Details

Package airdzticket 1.0.0 contains 2 files and shows no lifecycle scripts, network callbacks, credential access, or code-execution primitives that would harm an installer. No a static rule matches and no traced behaviors of concern were identified. ## Source: ghsa-malware (6ea7871fb5e60392f9aa2e61c22a8aeb126f5cb02a103d17e4c8385e63476345) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html hides redirect logic behind heavy obfuscation.
Turnstile callbacks invoke code that constructs a destination URL.
It copies every current URL query parameter to that hidden destination.
It navigates there with window.location.replace().
The page impersonates a Cloudflare security verification screen.

Evidence against

package.json has no lifecycle scripts.
No Node entrypoint, filesystem access, or child-process behavior is present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

5 High1 Low

HighAi Review Evidence

LowNo License