registry / Credential exfiltration / fghvbmniwu
fghvbmniwu
This report shows the evidence for fghvbmniwu@1.0.0. 2 of 2 known versions are blocked or flagged. The newest version, 1.0.1, is blocked. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection shows a deceptive browser flow with obfuscated external redirect and query forwarding; it is unrelated to a plausible npm package function. Absence of install hooks does not mitigate the runtime web attack.
Static reason
No blocking static signals were detected.
Trigger
A user opens index.html and the embedded Turnstile callback fires, including failure callbacks.
Impact
Can steer users through a deceptive verification flow and disclose URL-carried data to the redirect destination.
Mechanism
Obfuscated query-parameter forwarding browser redirect
Attack narrative
The sole package payload impersonates a Cloudflare verification page. Once any configured Turnstile callback runs, obfuscated JavaScript builds a Microsoft login URL, appends every current query parameter, and replaces the current browser location. The misleading UI, concealed redirect logic, and indiscriminate query forwarding establish a phishing/data-forwarding attack surface.
AI rationale
Source inspection shows a deceptive browser flow with obfuscated external redirect and query forwarding; it is unrelated to a plausible npm package function. Absence of install hooks does not mitigate the runtime web attack.
Evidence
package.jsonindex.html
Network endpoints2
challenges.cloudflare.com/turnstile/v0/api.jslogin.microsoftonline.com
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.html is a faux Cloudflare verification page with heavily obfuscated script.
- The Turnstile completion, error, expiry, timeout, and unsupported callbacks all invoke the redirect handler.
- The handler constructs an obfuscated Microsoft-login URL, copies every current-page query parameter, then redirects the browser.
- The package has no stated functionality beyond this deceptive redirect page.
Evidence against
- package.json has no lifecycle scripts, dependencies, or CLI entrypoint.
- No local file, environment, or process access is present.
Behavioral surface
NoLicense
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
4 High1 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
LowNo License
Affected versions and remediation
This report applies to fghvbmniwu@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing fghvbmniwu@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.