registry / Credential exfiltration / demo-awesome-date-parser-test

demo-awesome-date-parser-test

This report shows the evidence for demo-awesome-date-parser-test@0.0.3. 7 of 7 known versions are blocked or flagged. The newest version, 0.0.7, is blocked. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source inspection confirms malicious runtime behavior behind the package’s exported date parser. Lack of lifecycle hooks limits installation-time exposure but does not mitigate the activated browser payload.

Static reason

One or more suspicious static signals were detected.

Trigger

Application calls demoParseDate() in a browser-like page.

Impact

User-submitted form data can be sent to a host-derived endpoint; remote same-origin code can execute.

Mechanism

Obfuscated browser injection, form harvesting, exfiltration, and dynamic code loading

Attack narrative

The ostensibly date-parsing export runs browser injection on use. It hooks form submission, reads named fields and message content, stores data locally, sends it through host-derived fetch and sendBeacon URLs, and uses eval/Function/dynamic import to execute further code. This is unrelated to date parsing and constitutes concrete data exfiltration.

AI rationale

Evidence

package.jsonsrc/index.jssrc/index.d.ts

Network endpoints2

//<page-host>/leak?data_stolen_on_unload_base64=<data>//<page-host>/<host-derived fetch path>

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

src/index.js is heavily obfuscated and exposes a date-parser export.
demoParseDate() invokes injectScriptIfNeeded() at runtime.
Injected logic captures form name/email/message values and stores them in localStorage.
It exfiltrates captured values with fetch and unload sendBeacon calls.
It dynamically executes eval, Function, setTimeout strings, and import().
It downloads an embedded PDF and overwrites clipboard text.

Evidence against

package.json has no preinstall/install/postinstall hooks.
No child-process or local filesystem behavior was found.

Behavioral surface

Source

DynamicRequireEval

Supply chain

HighEntropyStringsMinifiedObfuscatedTrivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 139 KB of source

Source & flagged code

3 flagged

src/index.jsView file

1const a0_0xac94da=a0_0x4739;function a0_0x4739(_0x516e18,_0x57f767){_0x516e18=_0x516e18-0x1e8;const _0x454b4d=a0_0x454b();let _0x47397e=_0x454b4d[_0x516e18];if(a0_0x4739['mHNjyy']=...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

src/index.jsView on unpkg · L1

1const a0_0xac94da=a0_0x4739;function a0_0x4739(_0x516e18,_0x57f767){_0x516e18=_0x516e18-0x1e8;const _0x454b4d=a0_0x454b();let _0x47397e=_0x454b4d[_0x516e18];if(a0_0x4739['mHNjyy']=...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/index.jsView on unpkg · L1

1const a0_0xac94da=a0_0x4739;function a0_0x4739(_0x516e18,_0x57f767){_0x516e18=_0x516e18-0x1e8;const _0x454b4d=a0_0x454b();let _0x47397e=_0x454b4d[_0x516e18];if(a0_0x4739['mHNjyy']=...

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.jsView on unpkg · L1

Source & flagged code

3 flagged · loading source

src/index.jsView file

1const a0_0xac94da=a0_0x4739;function a0_0x4739(_0x516e18,_0x57f767){_0x516e18=_0x516e18-0x1e8;const _0x454b4d=a0_0x454b();let _0x47397e=_0x454b4d[_0x516e18];if(a0_0x4739['mHNjyy']=...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

src/index.jsView on unpkg · L1

1const a0_0xac94da=a0_0x4739;function a0_0x4739(_0x516e18,_0x57f767){_0x516e18=_0x516e18-0x1e8;const _0x454b4d=a0_0x454b();let _0x47397e=_0x454b4d[_0x516e18];if(a0_0x4739['mHNjyy']=...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/index.jsView on unpkg · L1

1const a0_0xac94da=a0_0x4739;function a0_0x4739(_0x516e18,_0x57f767){_0x516e18=_0x516e18-0x1e8;const _0x454b4d=a0_0x454b();let _0x47397e=_0x454b4d[_0x516e18];if(a0_0x4739['mHNjyy']=...

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.jsView on unpkg · L1

Findings

2 High2 Medium3 Low

HighObfuscated Payload Loadersrc/index.js

HighObfuscated

MediumDynamic Requiresrc/index.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalsrc/index.js

LowHigh Entropy Strings

Affected versions and remediation

This report applies to demo-awesome-date-parser-test@0.0.3.

The versions list below shows the verdict for each recorded version.

Avoid installing demo-awesome-date-parser-test@0.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 07:21:08.768Z (UTC).

Source advisory published: 2026-07-27 15:47:01.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

7 known versions

0.0.7latestMaliciousMalwareBlockPublishedJul 27, 2026, 9:38 AM 0.0.6MaliciousMalwareBlockPublishedJul 27, 2026, 9:28 AM 0.0.5MaliciousMalwareBlockPublishedJul 27, 2026, 8:43 AM 0.0.4MaliciousMalwareBlockPublishedJul 27, 2026, 8:40 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Source & flagged code

Related packages

Other credential exfiltration packages