registry / bgncvhferucfds / 1.0.0

bgncvhferucfds@1.0.0

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Opening the shipped HTML displays a fake verification page. After Turnstile completion, obfuscated code redirects the browser to a concealed destination while forwarding query parameters.

Static reason

No blocking static signals were detected.

Trigger

A user opens index.html and completes or errors the Turnstile challenge.

Impact

Can funnel users and URL-carried data to an undisclosed external site.

Mechanism

Obfuscated query-preserving browser redirect behind a security-verification lure.

Attack narrative

The sole shipped artifact is a Cloudflare-lookalike HTML page. Its Turnstile callback uses obfuscated code and anti-analysis behavior to construct a hidden destination, forwards the page's query parameters to it, and redirects the browser. This is a concrete deceptive redirect payload, not a normal npm library function.

Rationale

Although installation itself has no lifecycle execution, the package intentionally ships a browser-executed deceptive redirect payload with a concealed destination. The lack of a legitimate package function and the random package identity strengthen the malicious assessment.

Evidence

package.jsonindex.html

Network endpoints2

challenges.cloudflare.comwww.cloudflare.com/

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13784

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in bgncvhferucfds (npm)

Details

The package's sole content is a single obfuscated HTML file declared as `main`. When loaded in a browser, the page renders a fake Cloudflare Turnstile 'Just a moment...' verification screen, reconstructs a URL from string fragments that resolves to login.microsoft.com, and redirects the browser to that URL carrying the current page's query parameters. There are no lifecycle scripts, no JavaScript entry point, and the HTML is not executed by `npm install` or `require()`, so a developer installing the package is not directly attacked. The package abuses the npm registry (and its public CDN mirrors such as unpkg/jsDelivr) as free hosting for a Microsoft-credential phishing lure, using the Cloudflare-challenge cover story to bounce victims into an attacker-parameterized Microsoft login flow. ## Source: ghsa-malware (af08b658efd69810d2d9c7b0109dd6e5d00640abf1501a237c8c5cc0fa4d880f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html masquerades as a Cloudflare security-verification page.
onTurnstileComplete contains heavily obfuscated JavaScript and anti-analysis code.
The callback builds a concealed target URL, copies all current query parameters, then replaces window.location.
package.json ships index.html as the sole main file.

Evidence against

package.json has no lifecycle scripts or dependencies.
No local file writes, child-process use, or Node-side credential harvesting were found.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

1 flagged

package.jsonView file

•Published source reference

High

Ai Review Evidence

package.json ships index.html as the sole main file.

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•Published source reference

High

Ai Review Evidence

package.json ships index.html as the sole main file.

package.jsonView on unpkg

Findings

4 High1 Low

HighAi Review Evidence

HighAi Review Evidencepackage.json

LowNo License