registry / Credential exfiltration / egair0810
egair0810
This report shows the evidence for egair0810@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe deceptive UI, intentional concealment, and unconditional forwarding of browser query data to an obfuscated destination establish a concrete exfiltration chain. Lack of install hooks does not mitigate the user-triggered browser attack surface.
Static reason
No blocking static signals were detected.
Trigger
A user opens the packaged HTML page and the Turnstile callback runs.
Impact
Sensitive tokens or other values embedded in the visited URL can be disclosed to an undisclosed destination.
Mechanism
Obfuscated query-parameter forwarding and redirect.
Attack narrative
This is not a functional npm library: its sole shipped entrypoint is a Cloudflare-lookalike HTML page. After its challenge callbacks, obfuscated code constructs a hidden target URL, copies all current URL query parameters into it, and replaces the browser location. That behavior can relay URL-borne authentication or reset tokens to an undisclosed party.
AI rationale
The deceptive UI, intentional concealment, and unconditional forwarding of browser query data to an obfuscated destination establish a concrete exfiltration chain. Lack of install hooks does not mitigate the user-triggered browser attack surface.
Evidence
package.jsonindex.html
Network endpoints1
challenges.cloudflare.com/turnstile/v0/api.js
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json exposes only index.html and has no stated package functionality.
- index.html presents a Cloudflare-style security-verification page.
- onTurnstileComplete contains heavily obfuscated, anti-analysis JavaScript.
- The callback creates an obfuscated target URL, copies every window.location query parameter, then redirects the browser.
Evidence against
- No npm lifecycle scripts are declared.
- No local filesystem, shell, or Node-process access is present.
Behavioral surface
NoLicense
Source & flagged code
1 flagged · loading sourcepackage.jsonView file
•Published source reference
High
Ai Review Evidence
package.json exposes only index.html and has no stated package functionality.
package.jsonView on unpkgFindings
4 High1 Low
HighAi Review Evidencepackage.json
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
LowNo License
Affected versions and remediation
This report applies to egair0810@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing egair0810@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.