registry / Destructive action / chunk-yr2m2mz9
chunk-yr2m2mz9
This report shows the evidence for chunk-yr2m2mz9@1.0.2. 2 of 3 known versions are blocked or flagged. The newest version, 1.0.3, is flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiAlthough it has no install hook or network activity, the source implements concealed, hostile browser UI lockout behavior. The obfuscated published bundle corresponds to the readable source payload.
Static reason
One or more suspicious static signals were detected.
Trigger
Loading dist/chunk-YR2M2MZ9.js in a browser context without a matching configured hostname
Impact
A victim page can be made unusable and its user input blocked.
Mechanism
Full-page UI lockout and script self-removal
Attack narrative
The shipped browser chunk creates a top-level overlay, hides overflow, disables body pointer events, and prevents all keydown events. It retains interaction only for its overlay and then removes the executing script element, which conceals its source from the document. This is a deliberate page-denial payload, not a normal library capability.
AI rationale
Although it has no install hook or network activity, the source implements concealed, hostile browser UI lockout behavior. The obfuscated published bundle corresponds to the readable source payload.
Evidence
chunk-original.jsdocument.documentElementdocument.bodydocument.currentScript
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The bundle hides its displayed text through numeric character decoding.
- When loaded in a browser, it adds a full-screen overlay and disables page interaction.
- It captures every keydown event and prevents it from reaching the page.
- It removes its own script element after execution.
Evidence against
- package.json has no install lifecycle hook.
- No network endpoint, credential collection, or file access is present in the inspected source.
Behavioral surface
HighEntropyStringsMinifiedObfuscated
Source & flagged code
5 flagged · loading sourcedist/chunk-YR2M2MZ9.jsView file
1function _0x2dd1(){var _0x4882a3=['location','auto','118744jbHaHj','__CHUNK_CONFIG__','keydown','1021101ogGhhr','overflow','slice','defineProperty','style','body','465764JbwXQs','c...
L2:
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/chunk-YR2M2MZ9.jsView on unpkg · L1chunk-original.jsView file
11function d(i) {
var a = _k[i], s = '';
for (var j = 0; j < a.length; j++) {
s += String.fromCharCode(a[j] - 7);
}
return s;
}
High
Ai Review Evidence
The bundle hides its displayed text through numeric character decoding.
chunk-original.jsView on unpkg · L1149document.documentElement.appendChild(o);
document.documentElement.style.overflow = 'hidden';
document.body.style.overflow = 'hidden';
document.body.style.pointerEvents = 'none';
o.style.pointerEvents = 'auto';
High
Findings
6 High1 Medium2 Low
HighObfuscated Payload Loaderdist/chunk-YR2M2MZ9.js
HighObfuscated
HighAi Review Evidencechunk-original.js
HighAi Review Evidencechunk-original.js
HighAi Review Evidencechunk-original.js
HighAi Review Evidencechunk-original.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to chunk-yr2m2mz9@1.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing chunk-yr2m2mz9@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.