registry / Credential exfiltration / egypt0811
egypt0811
This report shows the evidence for egypt0811@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe concrete browser redirect and query forwarding are attack behavior, while the opaque destination and deceptive verification facade add concealment. No install hook is required because the declared package payload activates when rendered.
Static reason
No blocking static signals were detected.
Trigger
User opens or otherwise renders index.html and the Turnstile callback fires.
Impact
Can send users and URL-borne tokens to an undisclosed external site.
Mechanism
Obfuscated browser redirect with query-parameter forwarding
Attack narrative
The package exposes an HTML page as its npm main entrypoint. That page presents a Cloudflare-like verification UI, then its obfuscated callback builds an external URL, copies every window.location.search parameter into it, and redirects with window.location.replace. The actual destination is concealed by string obfuscation, preventing user review of where query data is sent.
AI rationale
The concrete browser redirect and query forwarding are attack behavior, while the opaque destination and deceptive verification facade add concealment. No install hook is required because the declared package payload activates when rendered.
Evidence
package.jsonindex.html
Network endpoints3
challenges.cloudflare.comwww.cloudflare.com/?utm_source=challenge&utm_campaign=mwww.cloudflare.com/privacypolicy/
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.html registers Turnstile completion callback that redirects the browser.
- Obfuscated JavaScript constructs a remote URL and calls window.location.replace.
- All existing URL query parameters are copied to the redirect target.
- Payload is heavily obfuscated and mislabeled as a Cloudflare verification page.
Evidence against
- package.json has no lifecycle scripts or dependencies.
- No Node filesystem, process, or child-process behavior is present.
Behavioral surface
NoLicense
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
4 High1 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
LowNo License
Affected versions and remediation
This report applies to egypt0811@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing egypt0811@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.