registry / fghvbmniwu / 1.0.0

fghvbmniwu@1.0.0

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Loading index.html presents a false security challenge. Its callback forwards all page query parameters to an obfuscated external login URL and redirects the browser.

Static reason

No blocking static signals were detected.

Trigger

A user opens index.html and the embedded Turnstile callback fires, including failure callbacks.

Impact

Can steer users through a deceptive verification flow and disclose URL-carried data to the redirect destination.

Mechanism

Obfuscated query-parameter forwarding browser redirect

Attack narrative

The sole package payload impersonates a Cloudflare verification page. Once any configured Turnstile callback runs, obfuscated JavaScript builds a Microsoft login URL, appends every current query parameter, and replaces the current browser location. The misleading UI, concealed redirect logic, and indiscriminate query forwarding establish a phishing/data-forwarding attack surface.

Rationale

Source inspection shows a deceptive browser flow with obfuscated external redirect and query forwarding; it is unrelated to a plausible npm package function. Absence of install hooks does not mitigate the runtime web attack.

Evidence

package.jsonindex.html

Network endpoints2

challenges.cloudflare.com/turnstile/v0/api.jslogin.microsoftonline.com

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13808

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in fghvbmniwu (npm)

Details

Package contains a single index.html declared as `main`, which is a Cloudflare-branded 'Just a moment...' clone embedding a Turnstile widget and heavily obfuscated JavaScript (obfuscator.io-style `_0x...` identifiers, shuffled string array, control-flow flattening) that assembles a redirect URL at runtime and assigns it to `window.location`, forwarding the current query string. There are no preinstall/install/postinstall/prepare lifecycle scripts, and `main` points to HTML that Node cannot require or import, so installing or requiring this package does not execute code on a developer machine or build system. The behavior only affects a browser that loads this file via a CDN mirror (unpkg/jsdelivr), consistent with abuse of the npm registry as free CDN hosting for a phishing/redirect landing page rather than an attack on the installer. ## Source: ghsa-malware (8a629c0894290984713933fbfcb91031f53d8468f660864b43f837c02b2ebe5e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 91.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html is a faux Cloudflare verification page with heavily obfuscated script.
The Turnstile completion, error, expiry, timeout, and unsupported callbacks all invoke the redirect handler.
The handler constructs an obfuscated Microsoft-login URL, copies every current-page query parameter, then redirects the browser.
The package has no stated functionality beyond this deceptive redirect page.

Evidence against

package.json has no lifecycle scripts, dependencies, or CLI entrypoint.
No local file, environment, or process access is present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

4 High1 Low

HighAi Review Evidence

LowNo License