registry / cvmbxcjiasdg / 1.0.1

cvmbxcjiasdg@1.0.1

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Opening the shipped HTML and completing or failing its apparent Turnstile challenge redirects the browser. All URL query parameters are transferred to an obfuscated third-party destination.

Static reason

No blocking static signals were detected.

Trigger

A user opens index.html and any registered Turnstile callback fires.

Impact

Tokens or other sensitive query values can be disclosed to an attacker-controlled destination.

Mechanism

Obfuscated query-parameter exfiltration followed by browser redirect.

Attack narrative

The package ships a fake Cloudflare-style verification page. Its callback constructs an obfuscated non-Cloudflare URL, appends each parameter from the current page URL, then redirects there. Because the same callback handles successful and failed verification states, the collection-and-redirect path is broadly triggered when the page is opened.

Rationale

Direct inspection confirms a concrete, obfuscated query-parameter exfiltration and redirect chain in the only shipped entrypoint. The absence of npm lifecycle hooks does not remove the malicious browser-side behavior.

Evidence

package.jsonindex.html

Network endpoints1

challenges.cloudflare.com

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13799

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in cvmbxcjiasdg (npm)

Details

The package contains a single index.html file declared as `main` and no JavaScript entry point, lifecycle scripts (preinstall/install/postinstall/prepare), or library exports. The HTML mimics a Cloudflare 'Just a moment...' Turnstile challenge and embeds obfuscator.io-style JavaScript with a custom base64 string array. When the fake challenge completes, decoded strings are used to construct a URL via `new URL(...)`, the current page's query parameters are forwarded via `URLSearchParams(window.location.search).forEach(...targetUrl.searchParams.append...)`, and the browser is navigated with `window.location.replace(targetUrl.toString())`. The redirect only executes in a browser that renders index.html; `npm install` and `require()` of this package run no code and touch no installer resources. The artifact appears to be an abuse of the npm registry as a static host for a phishing/redirect lure rather than an attack on developers installing the package. ## Source: ghsa-malware (e19fa62b42fed4ea0f175e4fa4838fefd1072ffef406b9342de3e187b9529ebf) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html contains heavily obfuscated browser code.
onTurnstileComplete builds a non-Cloudflare target URL.
It copies every window.location search parameter into that target.
It redirects the browser with location.replace.
The callback is registered for success, error, expiry, timeout, and unsupported Turnstile states.

Evidence against

package.json has no lifecycle scripts.
No filesystem or child-process behavior is present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

5 High1 Low

HighAi Review Evidence

LowNo License