registry / Credential exfiltration / cvmbxcjiasdg
cvmbxcjiasdg
This report shows the evidence for cvmbxcjiasdg@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect inspection confirms a concrete, obfuscated query-parameter exfiltration and redirect chain in the only shipped entrypoint. The absence of npm lifecycle hooks does not remove the malicious browser-side behavior.
Static reason
No blocking static signals were detected.
Trigger
A user opens index.html and any registered Turnstile callback fires.
Impact
Tokens or other sensitive query values can be disclosed to an attacker-controlled destination.
Mechanism
Obfuscated query-parameter exfiltration followed by browser redirect.
Attack narrative
The package ships a fake Cloudflare-style verification page. Its callback constructs an obfuscated non-Cloudflare URL, appends each parameter from the current page URL, then redirects there. Because the same callback handles successful and failed verification states, the collection-and-redirect path is broadly triggered when the page is opened.
AI rationale
Direct inspection confirms a concrete, obfuscated query-parameter exfiltration and redirect chain in the only shipped entrypoint. The absence of npm lifecycle hooks does not remove the malicious browser-side behavior.
Evidence
package.jsonindex.html
Network endpoints1
challenges.cloudflare.com
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.html contains heavily obfuscated browser code.
- onTurnstileComplete builds a non-Cloudflare target URL.
- It copies every window.location search parameter into that target.
- It redirects the browser with location.replace.
- The callback is registered for success, error, expiry, timeout, and unsupported Turnstile states.
Evidence against
- package.json has no lifecycle scripts.
- No filesystem or child-process behavior is present.
Behavioral surface
NoLicense
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
5 High1 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
LowNo License
Affected versions and remediation
This report applies to cvmbxcjiasdg@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing cvmbxcjiasdg@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.