Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Blocked & quarantined

Arbitrary JavaScript can run in the visitor's browser origin.

View on npm All versions

registry / browselucide / 1.0.4

browselucide@1.0.4

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Opening the packaged HTML executes a remote third-party script and obfuscated runtime loader. The loader fetches computed remote content and dynamically executes reconstructed code.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user opens or serves index.html.

Impact

Arbitrary JavaScript can run in the visitor's browser origin.

Mechanism

page-load remote script injection and dynamic remote-code execution

Attack narrative

When the included web page is opened, it immediately loads JavaScript from c.vipersfutbol.com. Its obfuscated main bundle also fetches a computed URL and invokes new Function on reconstructed values, creating a remote-controlled execution path in the page context. There is no npm install hook, but the runtime behavior is concrete and unsafe.

Rationale

The package embeds an undisclosed external script and an obfuscated fetch-plus-new-Function loader activated by opening its page. This is a concrete remote code execution surface, not merely a benign browser dependency.

Evidence

index.htmlassets/index-_E4fBqHJ-eac502ad.jspackage.json

Network endpoints1

c.vipersfutbol.com/script.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html loads an untrusted external script from c.vipersfutbol.com on page load.
The primary bundled entry is heavily obfuscated and invokes new Function with reconstructed values.
The same entry fetches a computed remote URL, enabling remotely supplied runtime behavior.

Evidence against

package.json contains only name and version; no npm lifecycle hooks or Node entrypoints are declared.
No install-time filesystem or process-execution behavior was found.

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 22 file(s), 6.69 MB of source, external domains: 127.0.0.1, aomediacodec.github.io, cdn.jsdelivr.net, cloud-api.livekit.io, curl.se, emscripten.org, fingerprint.com, github.com, m1.openfpcdn.io, react.dev, twemoji.maxcdn.com, www.w3.org, www.zlib.net

Source & flagged code

5 flagged · loading source

assets/livekit-DqpdvE-G-eac502ad.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

assets/livekit-DqpdvE-G-eac502ad.jsView on unpkg · L13

7cpa7/m20fhz.jsView file

17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(... L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

7cpa7/m20fhz.jsView on unpkg · L17

assets/index-_E4fBqHJ-eac502ad.jsView file

Findings

3 High6 Medium4 Low

HighObfuscated Payload Loaderassets/index-_E4fBqHJ-eac502ad.js

HighObfuscated

HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa-eac502ad.js

MediumSecret Patternassets/livekit-DqpdvE-G-eac502ad.js

MediumDynamic Require7cpa7/m20fhz.js

MediumNetwork

MediumProtestware

MediumShips Wasm Module7cpa7/vpa1gg.wasm

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

99%Block

Verdict confidence

IntentMalware

TypeRemote Code Execution

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched malicious

Package metadata

npm

Version1.0.4

PublishedAug 17, 2026

Licensenone

Dependencies0

Integrityverified

Package size3.31 MB

Files97

Runtime surface

package.json

EntrypointsNo public entrypoints declared.

RuntimeNo engine / OS / CPU constraints

Artifact8.46 MB · 97 files1 signature(s)

Install lifecycleNo scripts declared.

Behavioral surface

ChildProcessDynamicRequireFilesystemNetworkWebSocketHighEntropyStrings

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

1(function(_0x33e283,_0x3f1117){const _0x2edf25={_0x1053f2:0x468,_0x11ba7e:0x1f1,_0x1344bd:0x291,_0x4ea311:0xdf3,_0x718669:0xcc6,_0x20031d:0x89e,_0xc7b29e:0x21c,_0xe686a4:0x1008,_0x...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

assets/index-_E4fBqHJ-eac502ad.jsView on unpkg · L1

7cpa7/vpa1gg.wasmView file

•path = 7cpa7/vpa1gg.wasm kind = wasm_module sizeBytes = 586279 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

7cpa7/vpa1gg.wasmView on unpkg

assets/fingerprint-Y5nV5FVa-eac502ad.jsView file

•matchType = normalized_sha256 matchedPackage = crazynut@2.0.0 matchedPath = assets/fingerprint-Y5nV5FVa.js matchedIdentity = npm:Y3JhenludXQ:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/fingerprint-Y5nV5FVa-eac502ad.jsView on unpkg

Minified

Obfuscated

Protestware

UrlStrings

NoLicense

LPM CLI

browselucide@1.0.4: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

5 flagged

assets/livekit-DqpdvE-G-eac502ad.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Package contains a possible secret pattern.

assets/livekit-DqpdvE-G-eac502ad.jsView on unpkg · L13

7cpa7/m20fhz.jsView file

Lines 1-31javascript

1(()=>{let e,t;var r,i,n,s,o,a,A={8770(

e

,

t

,

r

){

var

i

=

{

"./"

:

"6418"

,

"./client"

:

"6039"

,

"./client.ts"

:

"6039"

,

"./dom/attr"

:

"8806"

,

"./dom/attr.ts"

:

"8806"

,

"./dom/beacon"

:

"7265"

,

"./dom/beacon.ts"

:

"7265"

,

"./dom/cookie"

:

"8227"

,

"./dom/cookie.ts"

:

"8227"

,

"./dom/css"

:

"8114"

,

"./dom/css.ts"

:

"8114"

,

"./dom/document"

:

"6820"

,

"./dom/document.ts"

:

"6820"

,

"./dom/element"

:

"1733"

,

"./dom/element.ts"

:

"1733"

,

"./dom/fontface"

:

"737"

,

"./dom/fontface.ts"

:

"737"

,

"./dom/fragments"

:

"2452"

,

"./dom/fragments.ts"

:

"2452"

,

"./dom/history"

:

"4397"

,

"./dom/history.ts"

:

"4397"

,

"./dom/open"

:

"5421"

,

"./dom/open.ts"

:

"5421"

,

"./dom/origin"

:

"8703"

,

"./ ..

.

2

3// SCRAMJET FUNCTION INTERCEPT

4// target: ${e}

5// frame: ${r}

6// location: ${s}

7

8function apply(fn, that, args) {

9 return Reflect.apply(fn, that, args);

10}

11

12function construct(fn, args, newTarget) {

13 return Reflect.construct(fn, args, newTarget);

14}

15

16return { apply, construct };

17

18//# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(a.fn,a.args,a.newTarget))};return(r.construct(a),s)?n:o(a.fn,a.args,a.newTarget)}),r.apply&&(l.apply=(e,t,i)=>{let s,o=!1,a={fn:e,this:t,args:i,newTarget:null,return:e=>{o=!0,s=e},call:()=>(o=!0,s=n(a.fn,a.this,a.args))};if(!this.flagEnabled("debugTrampolines")&&this.flagEnabled("allowFailedIntercepts"))return(r.apply(a),o)?s:n(a.fn,a.this,a.args);let A=g.$D.prepareStackTrace,l=this;g.$D.prepareStackTrace=function(e, ...

19//# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arrayBuffer()),o.url,e.context,r.meta,r.isModule);default:return o.body}}},6967(e,t,r){r.d(t,{A4:()=>u});var i=r(3235),n=r(5657),s=r(7492),o=r(4e3),a=r(2967),A=r(7959),l=r(3129),c=r(49),h=r(5994);async function u(e,t){var r;let i,u=(0,s.T)(t,e);if("blob:"===(r=u.url).protocol||"data:"===r.protocol)return d(e,t,u);let m={};if(await l.C.dispatch(e.hooks.fetch.intercept,{request:t,parsed:u},m),m.response)return m.response;i ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

7cpa7/m20fhz.jsView on unpkg · L17

20 background-color: ${{log:"#000",warn:"#f80",error:"#f00",debug:"transparent"}[e]};

21 color: ${{log:"#fff",warn:"#fff",error:"#fff",debug:"gray"}[e]};

22 padding: ${{log:2,warn:4,error:4,debug:0}[e]}px;

23 font-weight: bold;

24 font-family: monospace;

25 font-size: 0.9em;

26 `,`${"debug"===e?"color: gray":""}`,...i)},log:function(e,...t){this.fmt("log",e,...t)},warn:function(e,...t){this.fmt("warn",e,...t)},error:function(e,...t){this.fmt("error",e,...t)},debug:function(e,...t){this.fmt("debug",e,...t)},time(e,t,r){let n,s=(0,i.wU)()-t;n=s<1?"BLAZINGLY FAST":s<500?"decent speed":"really slow",this.print("debug","[time]",`${r} was ${n} (${s.toFixed(2)}ms)`)}}},6372(e,t,r){r.d(t,{c:()=>s});var i=r(5994),n=r(2075);class s{cookies={};byDomain=new Map;defaultPath(e){let t=e.pathname;if(!t||!t.startsWith("/"))return"/";let r=t.lastIndexOf("/");return r<=0?"/":t.slice( ...

27${e}`):`${e}

28${c}`}}if((0,i.U5)("rewriterLogs",r,n.base))for(let e of A.errors)o.error("oxc parse error",e);return c}catch(a){if(o.warn("failed rewriting js for",t||"(unknown)",a.message,"string"!=typeof e

29`:`importScripts("${e}");

30`,c=r.interface.getWorkerInjectScripts(a,A,l),h=(0,n.o)(e,t,r,a,A);if("string"!=typeof h&&(h=(0,s.hS)(h)),(0,i.U5)("encapsulateWorkers",r,a.origin)){let e;h+=`//# sourceURL=${t}`,c+=l((e=h,`data:text/javascript;charset=utf-8;base64,${(0,o.K)(e)}`))}else c+=h;return c}},2075(e,t,r){r.d(t,{Ay:()=>o});let i=new TextEncoder;function n(e){return"string"==typeof e&&!!e.trim()}function s(e){for(let t=0;t<e.length;t++){let r=e.charCodeAt(t);if((r>=0&&r<=31||127===r)&&9!==r)return!0}return!1}let o=function(e){return n(e)?[e].map(e=>(function(e){var t,r,o;let a,A,l,c=e.split(";"),h=c.shift();if(!h||!h.t ...

31//# sourceMappingURL=scramjet.js.map

Long lines were clipped for display.

assets/index-_E4fBqHJ-eac502ad.jsView file

1(function(_0x33e283,_0x3f1117){const _0x2edf25={_0x1053f2:0x468,_0x11ba7e:0x1f1,_0x1344bd:0x291,_0x4ea311:0xdf3,_0x718669:0xcc6,_0x20031d:0x89e,_0xc7b29e:0x21c,_0xe686a4:0x1008,_0x...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

assets/index-_E4fBqHJ-eac502ad.jsView on unpkg · L1

7cpa7/vpa1gg.wasmView file

•path = 7cpa7/vpa1gg.wasm kind = wasm_module sizeBytes = 586279 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

7cpa7/vpa1gg.wasmView on unpkg

assets/fingerprint-Y5nV5FVa-eac502ad.jsView file

•matchType = normalized_sha256 matchedPackage = crazynut@2.0.0 matchedPath = assets/fingerprint-Y5nV5FVa.js matchedIdentity = npm:Y3JhenludXQ:2.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/fingerprint-Y5nV5FVa-eac502ad.jsView on unpkg

?

(0,s.hS)(

e

)

:

e

),(

0

,i.U5)(

"allowInvalidJs"

,r,n.base))return e;throw a}}Error.stackTraceLimit

=

50

},

5657

(

e

,

t

,

r

){r.

d

(t,{

$n

:()

=>

l,

IP

:()

=>

A

,

Oy

:()

=>

c,

v2

:()

=>

h});

var

i

=

r

(

6549

),n

=

r

(

7492

),s

=

r

(

5994

),o

=

r

(

7742

).

A

;

function

a

(

e

,

t

){

try

{

return

new

s.

xP

(e,t)}

catch

{

return

null

}}

function

A

(

e

,

t

,

r

){

let

i

=new

s.

xP

(e.

substring

(

5

));

return

"blob:"

+

r.origin.origin

+

i.pathname}

function

l

(

e

,

t

,

r

){

let

i

=new

s.

xP

(e.

substring

(

5

));

return

"blo ..

.