browselucide@1.0.5
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is not an install-time malware package, but it ships an opaque browser proxy that intercepts requests and forwards cookies. That concrete risky capability warrants a warning rather than publication as clean.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user opens the packaged web application and uses a routed proxy page.
Impact
Remote sites accessed through the proxy may receive session cookies managed by the application, and the opaque runtime prevents reliable auditing of further behavior.
Mechanism
Service-worker interception and rewritten proxy requests with cookie forwarding.
AI rationale
This is not an install-time malware package, but it ships an opaque browser proxy that intercepts requests and forwards cookies. That concrete risky capability warrants a warning rather than publication as clean.
Evidence
index.htmlqphcap.jsro2to/opppec.jsassets/GamesPage-HpAML_qx-08e7fc9f.js
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The browser application is deliberately obfuscated, including its request logic.
- The entry page loads a proxy runtime before the application.
- A service worker intercepts routed browser requests and returns proxy responses.
- The proxy runtime forwards a stored cookie header to WebSocket connections.
Evidence against
- package.json has no lifecycle scripts, dependencies, or Node entry points.
- No install-time file mutation, shell execution, or credential harvesting from the host was found.
- The fixed external hosts shown are CDN and analytics resources rather than a proven exfiltration endpoint.
Behavioral surface
ChildProcessDynamicRequireEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourceassets/livekit-DqpdvE-G-08e7fc9f.jsView file
13patternName = generic_password
severity = medium
line = 13
Medium
Secret Pattern
Package contains a possible secret pattern.
assets/livekit-DqpdvE-G-08e7fc9f.jsView on unpkg · L13assets/index-C9VH_1oZ-08e7fc9f.jsView file
1(function(_0x1dc6f9,_0x31a128){const _0x5e43d6={_0x35c290:0x32c,_0x24e0c2:0x450,_0x45c27c:0x624,_0x287739:0x1d9,_0x424ab9:0x3a6,_0x79d3f2:0x484,_0x2111e1:0x254,_0x4c14d3:0xdad,_0x2...
Low
Eval
Package source references a known benign dynamic code generation pattern.
assets/index-C9VH_1oZ-08e7fc9f.jsView on unpkg · L1assets/ChatPage-BBSYoMOT-08e7fc9f.jsView file
Findings
4 High5 Medium5 Low
HighObfuscated Payload Loaderassets/GamesPage-HpAML_qx-08e7fc9f.js
HighObfuscated
HighSemantic Analysis Limitedassets/fingerprint-Y5nV5FVa-08e7fc9f.js#virtual:normalized:round1
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa-08e7fc9f.js
MediumSecret Patternassets/livekit-DqpdvE-G-08e7fc9f.js
MediumDynamic Requireassets/ChatPage-BBSYoMOT-08e7fc9f.js
MediumNetwork
MediumShips Wasm Modulero2to/1q03jq.wasm
MediumStructural Risk Force Deep Review
LowEvalassets/index-C9VH_1oZ-08e7fc9f.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to browselucide@1.0.5.
See all versions of browselucide for other recorded verdicts.
- Review the evidence and your use of browselucide@1.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.