dsjklweuvhgsdcq@1.0.0
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package consists of an obfuscated HTML redirect page with an automatic redirect path and a server-selected destination. This deceptive behavior supports blocking it as malware.
Static reason
One or more suspicious static signals were detected.
Trigger
Opening the HTML page starts the inline script and its timer; the challenge callback also invokes the redirect routine.
Impact
Visitors may be sent to a server-selected destination without clear disclosure of where they will be taken.
Mechanism
The script requests a host URL, decrypts the response, fetches a policy result using a URL parameter, and navigates to the returned destination.
Attack narrative
Opening the page starts an obfuscated network flow that obtains and decrypts a redirect URL, then navigates the browser to the selected destination. A timer invokes the redirect routine shortly after the challenge layout appears, so the page does not rely solely on a visitor completing the challenge.
AI rationale
The package consists of an obfuscated HTML redirect page with an automatic redirect path and a server-selected destination. This deceptive behavior supports blocking it as malware.
Evidence
index.html
Network endpoints1
challenges.cloudflare.com/turnstile/v0/api.js
Decision evidence
public snapshotAI called this Malicious at 85.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package entrypoint is an HTML page with an inline runtime script and no declared lifecycle hooks.
- The page sends a fixed host key to an obfuscated endpoint, then decrypts the response into a URL.
- It uses a URL parameter to request a policy result and navigates the browser to the returned destination.
- After rendering its challenge layout, a timer calls the redirect routine automatically.
Evidence against
Behavioral surface
Network
HighEntropyStringsMinifiedPossibleObfuscation
NoLicense
Source & flagged code
8 flagged · loading sourceindex.htmlView file
182}
L183: function _0x5d4a(){const _0x5f5beb=['D3berNy','BguTy29UDgfPBG','wKLss2G','Es1Pza','u09MwMC','yLfArhi','yMLUza','mJf5sNvWyxy','C3Hfpq','ELLxvhK','CNjLCIiGAhjLzG','lMnMlxr1CM5ZDa','v...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.htmlView on unpkg · L182•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.htmlView on unpkg183=hostKey;const _0x173df2=await fetch(_0x7db89c(-_0x4d7253._0x4f7151,-_0x4d7253._0x5a3d8e,_0x4d7253._0x479786,_0x4d7253._0x2ff0b0)+_0x7db89c(_0x4d7253._0xa4ef9f,_0x4d7253._0x446225,_0x4d7253._0x112879,_0x4d7253._0x162095)
High
Ai Review Evidence
The page sends a fixed host key to an obfuscated endpoint, then decrypts the response into a URL.
index.htmlView on unpkg · L183Findings
8 High2 Medium2 Low
HighObfuscated Payload Loaderindex.html
HighSemantic Analysis Limitedindex.html
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
MediumNetwork
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to dsjklweuvhgsdcq@1.0.0.
See all versions of dsjklweuvhgsdcq for other recorded verdicts.
- Avoid installing dsjklweuvhgsdcq@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.