registry / kamafhbnowct / 1.0.0

kamafhbnowct@1.0.0

AI Security Review

scanned 24d ago · by lpm-firewall-ai

Opening index.html runs obfuscated browser code that resolves a concealed destination and redirects the visitor. The destination is selected through a remote policy request.

Static reason

One or more suspicious static signals were detected.

Trigger

A user opens the package's index.html entrypoint or completes the embedded Turnstile challenge.

Impact

Visitors can be sent to an undisclosed remote site with their existing URL parameters appended.

Mechanism

Encrypted host resolution, remote redirect lookup, and browser navigation.

Attack narrative

The package publishes an HTML file as its main entrypoint. When opened, its obfuscated script reconstructs an encrypted host, requests a redirect decision using a current-page parameter, and navigates the browser to the returned URL. It also routes Turnstile completion through the same hidden redirect handler. This concealment and undisclosed remote redirection are concrete hostile browser behavior.

AI rationale

The package has no npm lifecycle hook, but its sole runtime entrypoint is an obfuscated remote redirector. The hidden destination and parameter forwarding create a concrete malicious browser attack surface.

Evidence

index.html

Network endpoints1

challenges.cloudflare.com/turnstile/v0/api.js

OSV advisory

OpenSSF/OSV

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (87e15811e108a2a80c81c60340e92751a09556a88009dab85d150e1dad45a8a2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

kamafhbnowct@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code